php - 如何安全地实现 'Token Based Authentication' 以访问使用 PHPFox 开发的网站资源(即功能和数据)？

Question

我想使用在 PHPFox 中开发的网站代码中的方法和资源。

基本上，我会收到来自 iPhone/Android 的请求，我会收到请求并从 PHPFox 代码传递给相应的函数，获取该函数的响应并将其返回给设备。

为此，我使用 Slim 框架 开发了 REST API。

但我目前面临的主要障碍是访问 PHPFox 网站的资源(即功能和数据)。

我不明白我应该如何使用“基于 token 的身份验证”对用户进行身份验证以访问网站的资源。

如果有人可以通过一些有用的工作示例指导我正确的方向，那对我来说真的很有帮助。

注意:建议实现的“基于 token 的身份验证”应该非常安全且速度快。安全不应以任何方式受到损害。

以下是我自己试的代码，不知道对不对。我的做法是对还是错。请有人对其进行分析，并让我知道您对此的反馈。

为了创建一个 token ，我使用了这个函数，它以用户数据作为参数

define('SECRET_KEY', "fakesecretkey");

function createToken($data)
{
    /* Create a part of token using secretKey and other stuff */
    $tokenGeneric = SECRET_KEY.$_SERVER["SERVER_NAME"]; // It can be 'stronger' of course

    /* Encoding token */
    $token = hash('sha256', $tokenGeneric.$data);

    return array('token' => $token, 'userData' => $data);
}

因此用户可以验证自己并接收一个包含 token (genericPart + 他的数据，已编码)和未编码的 hisData 的数组:

function auth($login, $password)
{
    // we check user. For instance, it's ok, and we get his ID and his role.
    $userID = 1;
    $userRole = "admin";

    // Concatenating data with TIME
    $data = time()."_".$userID."-".$userRole;
    $token = createToken($data);
    echo json_encode($token);
}

然后用户可以将他的 token +他未编码的数据发送给我以检查:

define('VALIDITY_TIME', 3600);

function checkToken($receivedToken, $receivedData)
{
    /* Recreate the generic part of token using secretKey and other stuff */
    $tokenGeneric = SECRET_KEY.$_SERVER["SERVER_NAME"];

    // We create a token which should match
    $token = hash('sha256', $tokenGeneric.$receivedData);   

    // We check if token is ok !
    if ($receivedToken != $token)
    {
        echo 'wrong Token !';
        return false;
    }

    list($tokenDate, $userData) = explode("_", $receivedData);
    // here we compare tokenDate with current time using VALIDITY_TIME to check if the token is expired
    // if token expired we return false

    // otherwise it's ok and we return a new token
    return createToken(time()."#".$userData);   
}

$check = checkToken($_GET['token'], $_GET['data']);
if ($check !== false)
    echo json_encode(array("secureData" => "Oo")); // And we add the new token for the next request

我说的对吗？

谢谢。

Answer 1

首先，您应该了解什么是基于 token 的身份验证。可以这样解释。

The general concept behind a token-based authentication system is simple. Allow users to enter their username and password in order to obtain a token which allows them to fetch a specific resource - without using their username and password. Once their token has been obtained, the user can offer the token - which offers access to a specific resource for a time period - to the remote site.

Read more

现在让我们看看在您的 REST Web 服务中实现它的步骤是什么。

It will use the following flow of control:

• The user provides a username and password in the login form and clicks Log In.
• After a request is made, validate the user on the backend by querying in the database. If the request is valid, create a token by using the user information fetched from the database, and then return that information in the response header so that we can store the token browser in local storage.
• Provide token information in every request header for accessing restricted endpoints in the application.
• If the token fetched from the request header information is valid, let the user access the specified end point, and respond with JSON or XML.

控制流程见下图

您可能想知道什么是 JWT

JWT stands for JSON Web Token and is a token format used in authorization headers. This token helps you to design communication between two systems in a secure way. Let's rephrase JWT as the "bearer token" for the purposes of this tutorial. A bearer token consists of three parts: header, payload, and signature.

• The header is the part of the token that keeps the token type and encryption method, encoded in base64.
• The payload includes the information. You can put any kind of data like user info, product info and so on, all of which is also stored in base64 encoding.
• The signature consists of combinations of the header, payload, and secret key. The secret key must be kept securely on the server-side. You can see the JWT schema and an example token below;

您不需要实现不记名 token 生成器，因为您可以使用 php-jwt .

希望以上内容能解释您的困惑。如果您在实现基于 token 的身份验证时遇到任何问题，请告诉我。我可以帮你。