现在随着客户端的多样化、前端的不断发展，传统的基于cookie的会话控制限制越来越多。cookie的跨域问题，移动端native app 对于cookie支持的缺失。今天就来看下另一种解决方案。
用户认证的本质
用户认证分为会话控制(authentication)和权限控制(authorization)。要实现会话控制，就需要一个身份认证的过程：
1.客户端提供认证凭证。eg：username password
2.服务器核对。
3.核对失败则返回失败信息。核对成功则返回成功标识，传统的方式是使用session，设置客户端cookie。
4.客户端请求需要认证的网址。传统的方式是由浏览器自动发送cookie到服务器端，服务器端核对sessionid。
基于token的认证系统
优点
基于token的认证系统解决了什么问题呢？
Cross-domain / CORS: cookies + CORS don't play well across different domains. A token-based approach allows you to make AJAX calls to any server, on any domain because you use an HTTP header to transmit the user information.
Stateless (a.k.a. Server side scalability): there is no need to keep a session store, the token is a self-contanined entity that conveys all the user information. The rest of the state lives in cookies or local storage on the client side.
CDN: you can serve all the assets of your app from a CDN (e.g. javascript, HTML, images, etc.), and your server side is just the API.
Decoupling: you are not tied to a particular authentication scheme. The token might be generated anywhere, hence your API can be called from anywhere with a single way of authenticating those calls.
Mobile ready: when you start working on a native platform (iOS, Android, Windows 8, etc.) cookies are not ideal when consuming a secure API (you have to deal with cookie containers). Adopting a token-based approach simplifies this a lot.
CSRF: since you are not relying on cookies, you don't need to protect against cross site requests (e.g. it would not be possible to <iframe>
your site, generate a POST request and re-use the existing authentication cookie because there will be none).
Performance: we are not presenting any hard perf benchmarks here, but a network roundtrip (e.g. finding a session on database) is likely to take more time than calculating an HMACSHA256
to validate a token and parsing its contents.
Login page is not an special case: If you are using Protractor to write your functional tests, you don't need to handle any special case for login.
Standard-based: your API could accepts a standard JSON Web Token (JWT). This is a standard and there are multiple backend libraries (.NET, Ruby, Java,Python, PHP) and companies backing their infrastructure (e.g. Firebase, Google,Microsoft). As an example, Firebase allows their customers to use any authentication mechanism, as long as you generate a JWT with certain pre-defined properties, and signed with the shared secret to call their API.
可以看到token解决了以下问题
- 跨域。ajax设置"Authorization header" and "Bearer。
- 状态无关。天然适合restful services。
- CDN。 专注api。
- 解耦。token可以随时生成，随处验证。
- 移动适用。移动端cookie支持不好。
- CSRF。这个需要具体情况具体分析。
- 性能。连接数据库查询session比对token进行解密更费时间。
- 标准化。 JSON WEB TOKEN (JWT) http://jwt.io/
区别
cookie-token-auth.png
缺点
token存储、传输。
- 对于reftful 客户端， 将其设置成GET或POST参数即可。
- 对于传统web。可存储在cookie里由浏览器自动传送，会有跨域问题。
- 或者存储在localsotrage里, 或者url里，或者放在页面里。需要用js手动取出，拼接到url里。这会加大工作量。适用范围有限。
- 利用"Authorization header" and "Bearer。
Accept:application/json, text/plain, /
Accept-Encoding:gzip, deflate, sdch
Accept-Language:zh-CN,zh;q=0.8,en;q=0.6,ja;q=0.4
Authorization:Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJmaXJzdF9uYW1lIjoiSm9obiIsImxhc3RfbmFtZSI6IkRvZSIsImVtYWlsIjoiam9obkBkb2UuY29tIiwiaWQiOjEyMywiaWF0IjoxNDMwMDI2MzI0LCJleHAiOjE0MzAwNDQzMjR9.wODsE0vHiGr8RruRppJ79JKqH_Fi_2QUBxNJDzM_nfY
Connection:keep-alive
Host:localhost:8080
If-None-Match:W/"e-87842b1a"
Referer:http://localhost:8080/
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.90 Safari/537.36
总结
本质上cookie和token在客户端的方式并没有区别。都是提供了一种认证信息传输的方式。
请关注后续文章_
网友评论