September 2021
Beginner to intermediate
392 pages
12h 13m
Chinese
book
Google系统架构解密： 构建安全可靠的系统
by Heather Adkins, Betsy Beyer, Paul Blankinship, Piotr Lewandowski, Ana Oprea, Adam Stubblefield
Content preview from Google系统架构解密： 构建安全可靠的系统
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
54
｜
第
5
章
想一下
McIlroy
、
Pinson
和
Tague
的建议——将系统的每个部分设计成各自只做好一件事，
就可以实现相互隔离。
小型
API
提供了更细粒度的控制面
，可以实现在自动化过程中添加错误保护机制。除了需
要配置的签名校验外，还可以要求（独立于自动化系统的）限速器针对每一个发布中的服
务器提供一个承载令牌
15
。你可以非常仔细地对该限速器进行测试，如果限速器是独立实现
的，那么影响自动化系统的缺陷不会同时影响它。独立的限速器还便于复用，因为它可以
限制配置文件发布的速度、同一服务器的二进制程序的发布、重启服务或者其他的安全检
查任务。
5.5
一种用于认证和授权决策的策略框架
认证
（名词）：验证用户或进程的
身份
。
授权
（名词）：评估来自特定认证方的请求
是否应该被允许
。
上一节中，我们建议为服务设计一个有限的管理类
API
，用于给特定的操作授予尽可能小
的权限。一旦该
API
存
在，你就必须决定如何控制对它的访问。访问控制涉及两个重要但
独立的步骤。
首先，你必须
认证
谁在产生连接。身份认证机制的复杂性有以下几个层次。
简单：接受 URL 参数中传递的用户名
例如
/service?username=admin
。
相对复杂：使用预先共享的密钥
例如
WP
A2-PSK
、
HTTP cookie
。
更加复杂：复杂的混合加密和证书方案
例如
TLS 1.3
、
OAuth
。
一般来说，更倾向于复用现有的强加密身份认证机制来标识
API
的调用方
。认证结果通常
表现为用户名、通用名称、“主体”或“角色”等。本节中使用“角色”来描述身份认证
的结果。 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.