January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
388
｜
第
12
章
持久连接的功能使得客户端能将不同的请求发布到一个线程中。标头中的内
容长度定义了每个请求发送数据的数量。
分块编码支持数据流和其他动态提供资源的使用实例（来自客户端或发送给
客户端的）。该功能通过转换编码实现：分块的标头与持续连接的线程是相
连的。
浏览器和代理能缓存基于缓存控制标头设置的内容
注
6
。资源通过利用标志位
来进行标记，标志位包括公共、私有、无缓存、无存储。
max-age
限定器用于
定义数据的旧版本应该被保存的最大时间量。
HTTP
授权机制
跟踪状态对很多应用都至关重要（如了解未授权用户和已登录用户之间的差
异，或者已付费与未付费用户之间的差异），但
HTTP
是与状态无关的协议。
如此一来，相关的应用可通过如下方式进行状态跟踪：
•
设置
cookies
。
•
在执行操作的
HTML
中放置令牌。
•
处理
HTTP
引用标头（显示用户访问的最后页面）。
第
7
章描述了
Kerberos
认证机制，通过这种方式为成功认证的用户提供证明。
该证明具有一定期间的法律效益，随后可以出现在各个请求中。
Web
应用也
以相同的方式运作——给授权用户提供一个线程令牌（作为
cookie
设置），
这个令牌可以提供给每个
HTTP
请求。
无论应用运行在哪些系统上，包括微软
IIS
在内的
Web
服务器通常支持
HTTP
认证。黑客可以通过某些支持的方法（如
WebDAV
或
HTTP PUT
功能），使
用认证过的请求标头上传恶意代码。图
12-5
总结了这一场景。
注 6： 参见 RFC 2616。
Web
应用体系结构
｜
389
应用
服务器
数据库 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.