Some thoughts on the security of Web services

First, the question:

When you develop a Web project, there are several issues with the security issue:

(1) Can the user forge a URL request to access it?

(2) The user does not log on the server, you can encapsulate the user name, password to access it?

(3) The parameters of the URL can be repeated attempts to brute force?

Second, the analysis of ideas:

First of all, what is security, the user's own stitching URL request must be wrong?

Our JS can write a request to the background, the user himself why not?

So, what is the security situation?

(1) The user has logged in the server session, and there is no time-out, can be normal request

(2) The requested user name password authentication is correct and has the requested permission

(3) The parameter format of stitching is correct, and the data matching is accepted in the background.

Third, the settlement:

(1) Use JWT, Shiro for security authentication, remove the user name password mismatch

(2) When a URL is accessed, the context of the specified access must be issued before the current request can be issued "the referrer property returns the URL of the document loaded into the current document"

(3) The URL request is encrypted, the user can not casually see the background request URL Information "feel encryption is not useful, to encrypt the text can also request, just can't judge the meaning of it"

Some thoughts on the security of Web services