June 2021
Intermediate to advanced
290 pages
9h 21m
Chinese
Content preview from Node与Express开发（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
194
第 18章
安全
今天，大多数网站和应用会有某种类型的安全需求。如果允许用户登录网站，或者要存
储用户的个人识别信息（
PII
）
，就需要为网站实现某种安全机制。本章将讨论
HTTP
安全
（
HTTPS
）和认证机制
。
HTTPS
为构建一个安全的网站打下了坚实的基础。对于认证机制，
本章主要关注第三方的认证。
安全是一个很大的主题，足以写一本书了。因此，本书准备把关注点放在如何利用现有的
认证模块上。当然可以自己写认证系统，但这会是一项艰巨的任务。况且，有几个很好的
理由支持优先使用第三方的登录方法，本章稍后会讨论。
18.1
HTTPS
提供安全服务的第一步就是使用
HTTPS
。互联网的本质使得某个第三方要拦截客户端跟服
务器之间传输的包是可能的。
HTTPS
对
这些包进行了加密，攻击者想要获得正在传输的信
息极其困难。（我说的是“极其困难”，而不是“不可能”，因为“完美安保”是不存在的。
不过对于银行业、企业安全和医护领域来说，
HTTPS
足够安全了。
）
可以把
HTTPS
看作网站安全加固的某种基础设施
。它并不提供认证，但为认证做了基础
性的工作。例如，认证系统很可能需要传输密码，如果密码未经加密就传输，无论认证做
得多么高级，系统都不安全。安全的强度是链条中最弱的一环，而链条中的第一环就是网
络协议。
在
HTTPS
协议中
，服务器有一个
公钥证书
，有时候也叫
SSL
证书，这个证书是
HTTPS
协
议运行的基础。目前
SSL
证书的标准格式为
X.509
。证书的背后是负责颁发证书的
证书中
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.