June 2021
Intermediate to advanced
290 pages
9h 21m
Chinese
Content preview from Node与Express开发（第2版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Cookie
和
Session
｜
91
9.1
提取敏感信息
要想让
Cookie
更安全，必须要有一个
Cookie
密钥
。这个
Cookie
密钥是一个只有服务器
端才知道的字符串，在把
Cookie
发给客户端之前先用它来加密
。
Cookie
密钥不是需要记
住的密码，因此也可以是一个随机的字符串。我经常使用受
xkcd
启发的随机密码生成器
（
xkcd-password-generator
）来生成
Cookie
密钥或一个随机数字。
把第三方的敏感信息提取到外部文件是很常见的操作。这些敏感信息包括
Cookie
密钥、
数
据库密码以及第三方
API
的
token
（
T
witter
、
Facebook
等）。这样做不仅可以减轻维护的
工作量（定位和更新这些信息更容易了），而且允许版本控制系统忽略这个敏感信息文件，
这对于托管在
GitHub
或其他开放的源码仓库的开源项目来说尤为重要。
既然如此，我们就把敏感信息提取到一个
JSON
文件
。创建一个名为
.credentials.development.
json
文件：
{
"cookieSecret":“……你的Cookie密钥”
}
这将是我们用于开发的敏感信息配置文件。按照这种方式，可以对产品、测试，或其他环
境分别准备不同的配置文件，各有各的用处。
我们准备在这个配置文件之上增加一层抽象，这样随着应用数量的增长，管理依赖可以更
容易。这一层抽象非常简单。创建一个名为
config.js
的文件：
const env = process.env.NODE_ENV || 'development'
const ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.