当前提审小程序包中可能包含明文的AppSecret,存在泄漏的安全风险?

小程序 文章 2022-02-16 17:40 817 0 全屏看文

AI助手支持GPT4.0

当前提审小程序包中可能包含明文的AppSecret,存在泄漏的安全风险?The current pre-audit mini-program package may contain plaintext AppSecret, is there a security risk of leakage?

当前提审小程序包中可能包含明文的AppSecret,存在泄漏的安全风险?

AppID:wxe19fe76707938a8c

你好,当前提审小程序包中可能包含明文的AppSecret,存在泄漏的安全风险。一旦被恶意用户通过技术手段获取你的AppSecret,对方可以通过调用API获取你的小程序敏感数据,如接口调用凭证、用户信息、用户使用数据、小程序码等。出于安全考虑,开发者应将AppSecret保存 到后台服务器中,并严格保密,不向任何第三方等透露。建议你立即调整技术方案,去除小程序包中的AppSecret字样并重置可能已泄漏的AppSecret,消除风险。

Appid: wxe19fe76707938a8c Hello, the current referral applet package may contain plaintext appsecret, which poses a security risk of disclosure. Once a malicious user obtains your appsecret through technical means, the other party can obtain your applet sensitive data by calling API, such as interface call credentials, user information, user use data, applet code, etc. For security reasons, developers should save appsecret to the background server and keep it strictly confidential and not disclose it to any third party. It is recommended that you immediately adjust the technical scheme, remove the word appsecret in the applet package, and reset the appsecret that may have been leaked to eliminate the risk.

回答:

社区技术运营专员-horanzhou:

你好,当前提审小程序包中可能包含明文的AppSecret(包括但不限于当前小程序的AppSecret、appsecret、secert、key、app_key、server_key);排查并去除小程序包中的AppSecret字样并重置可能已泄漏的(包括但不限于当前小程序的AppSecret、appsecret、secert、key、app_key、server_key),消除风险。

八九:

排查并去除小程序包中的AppSecret字样

王一鸣:

安全考虑请勿在前端暴漏AppSecret

-EOF-

AI助手支持GPT4.0