June 2021
Intermediate to advanced
290 pages
9h 21m
Chinese
Content preview from Node与Express开发（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
202
｜
第
18
章
csurf
中间件会处理其余的事情：如果
body
包含了一些字段，但没有合法的
_csrf
字段，
它就会抛出一个错误（请确保你的中间件里有一个处理错误的路由）。也可以试着去掉
_csrf
隐藏域，看看会发生什么。
如果你有一个
API
，很可能就不希望
csurf
中间件妨碍到它。如果希望限制
从其他网站到
API
的
访问，就应该研究一下某个
API
库（比如
connect-rest
）
的“
API key
”功能
。要想避免
csurf
妨碍到某个中间件，就在链入
csurf
之
前链入这个中间件。
18.3
认证
认证是一个庞大且复杂的主题。而且，对大多数出色的
Web
应用来说，它也是至关重要的
一个部分。我能够给你传授的最重要的一条智慧是“不要想着自己去做认证”。对于设计
一个安全的认证系统来说，涉及的种种考量太多、太复杂了。请看一下自己的名片，如果
上面没有印着“安全专家”，那么很可能你还没有做好这个准备。
我并非说不应该尝试去理解应用中的安全系统，只是建议不要尝试自己去建立它。对于下
面我推荐的认证技术，你可以放心地去研究它们的开源代码。这些开源代码无疑可以加深
理解，并且让你明白，为什么不应该贸然地独立承担这项任务。
18.3.1
认证与授权
虽然这两个词经常被互换着用，但它们是有差别的。
认证
指的是核对用户的身份。也就是
说，要核对他们的确是其所声称的身份。
授权
指的是要确定一个用户对什么有访问、修改
或查看的权限。例如，客户应该有访问他们账户信息的权限，而草地鹨旅游的一个雇员应
该有访问他人账户信息或售货单的权限。
认证（ ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.