原文链接:https://medium.com/@rcls/secure-client-side-authentication-using-refreshed-tokens-and-cookies-4dacc0bc8ff0
版权
令牌桶 客户端请求
To start off, this is my first article here. I’ve thought about writing it for a while now. Ever since we planned and implemented what we call a moderately secure way to actually authenticate client-side requests against our API where authentication tokens are refreshed and old ones are rapidly expired.
要开始了,这是我在这里的第一篇文章。 我已经考虑过写一段时间了。 自从我们计划并实施了所谓的中度安全方式,即根据我们的API对客户端请求进行实际身份验证,在该API中,身份验证令牌会更新,而旧令牌则会快速过期。
I thought I’d share the idea. I will not be diving into much detail here by using big code examples.
我以为我会分享这个想法。 在这里,我不会通过使用大型代码示例来详细介绍。
LocalStorage与Cookie(LocalStorage vs. Cookies)
We use JSON Web Tokens as authentication tokens. Tokens are generated when the user logs in with his credentials and contains information such as his username (or id). More about the payload below.
我们使用JSON Web令牌作为身份验证令牌。 当用户使用其凭据登录时会生成令牌,其中包含诸如用户名(或ID)