January 2018
Intermediate to advanced
203 pages
3h 59m
Chinese
Content preview from Web开发的身份和数据安全
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
通过
OAuth2
和
OpenIDConnect
实现安全的登录
｜
103
localStorage 访问的本地存储，不会过期，还有通过 window.sessionStorage
访问的会话存储，用户关闭浏览器标签页后即被抹除。
典型的
cookie
可以标记为 HttpOnly，确保
cookie
的值只能在服务器端访问。
这样可以防范
XSS
攻击，不过却抵御不了
XSRF/CSRF
攻击。这是很大的风险，
往往被忽略了。幸好，现代的
Web
框架通常都提供了安全机制（可能要在配
置中启用），能避免重放攻击等的威胁。这些概念在第
6
章详述。
自定义模式
在移动平台上，现在非常流行使用自定义的
URL
模式处理服务器与应用之间
的通信。一个
URL
可以分成这些部分：scheme://host/path?query。利用这
一点，应用可以定义这样的回调：myoauthapp://book/auth?callback。
使用资源属主凭据或客户端凭据授权
除了授权码许可流程之外，另一个流行的
OAuth 2.0
许可是资源属主凭据许
可（
https://tools.ietf.org/html/rfc6749#section-4.3
），这一流程在
OAuth 2.0
规范的
4.3
节定义。这个流程简化了获取访问令牌的过程，涉及的步骤更少（见
图
4-3
）。
根据规范，用户极度信任客户端时（例如设备的操作系统或权限较高的应用）
才应该使用这个流程。
客户端凭据许可类型（见图
4-4
）与资源属主凭据许可类型相似的地方是，客
户端也把它的凭据提供给服务提供方
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.