后端参数污染（HPP）与路由攻击防护最佳实践

后端参数污染（HPP）与路由攻击防护最佳实践概述参数污染与路由攻击利用重复/歧义参数与非规范路由混淆后端行为。通过规范化与白名单拒绝，可有效防护。参数白名单与规范化function canonicalQuery(params: URLSearchParams, allow: string[]): string {

const keys = allow.slice().sort()

const parts: string[] = []

for (const k of keys) {

const values = params.getAll(k)

if (values.length > 1) return '' // 拒绝重复参数

const v = params.get(k)

if (v !== null) parts.push(`${k}=${encodeURIComponent(v)}`)

}

return parts.join('&')

}

路由拒绝策略function isAmbiguous(path: string): boolean {

return /\/\/+/.test(path) || /\.\./.test(path)

}

function rejectIfAmbiguous(url: string): boolean {

const u = new URL(url)

return isAmbiguous(u.pathname) || canonicalQuery(u.searchParams, ['id', 'page', 'q']) === ''

}

敏感端点保护function protectSensitive(req: any): { allowed: boolean; status: number } {

const sensitive = req.path.startsWith('/admin') || req.path.startsWith('/payments')

if (!sensitive) return { allowed: true, status: 200 }

const url = `${req.origin}${req.path}${req.search || ''}`

return rejectIfAmbiguous(url) ? { allowed: false, status: 400 } : { allowed: true, status: 200 }

}

运维要点为关键端点建立参数白名单并拒绝重复与未知参数对非规范路径与目录穿越企图进行统一拒绝在日志中记录被拒绝的来源与模式，驱动规则完善通过规范化与白名单拒绝策略，可在后端有效防护参数污染与路由攻击。