Is your Domino OA web system secure?

Many enterprises and institutions that import Domino systems know that the Domino system is secure and reliable, but they do not know that the premise is to use the Notes Client ID authentication. Many developers use web access methods to develop images conveniently and quickly. They use the "Anonymous Access" method, don't you know that a very large security vulnerability is open to some people who know the principles of the Domino system!

For example, use *. nsf/All? OpenView: If you can see a lot of content you shouldn't have seen, it means that the system uses the "Anonymous Access" method. Note: "All" is the name of the view. Generally, the designer adds this view. If not, enter the corresponding search function. Generally, you can easily see the name of the view.

A system seems to be normally used by outsiders, but it cannot be said that its security is reliable. It can be said to be OK only when it can withstand the "Review" of insiders. Therefore, when evaluating a system, ask the layman to say "normal use", rather than "everything is normal" (only professionals are qualified to say this ).

Although it seems that this does not affect the use, it will give casual people or have ulterior motives to see things that should not be viewed. It seems simple, but it takes a lot of effort to block this vulnerability, especially for systems with many applications, it may be difficult to change it. From this, we can also see that, the value of an expert architect is that he can leverage the functions of the Domino system to avoid security vulnerabilities at the very beginning.

Therefore, it is hard to understand that many enterprises cannot put their OA systems on the Internet.
Some suggestions:
1. Be sure to add $ searchtemplatedefault to each database, instead of giving the system the opportunity to display the "Default full-text search screen"
2. Do not use the searchview function whenever possible. Users can easily edit URL strings to remove restrictions.
3. Use the "Anonymous Access" method with caution