json - 使用 REST (HTTP) 的基于角色的访问控制？

Question

我正在创建一个带有 JavaScript 客户端的系统，该客户端将通过 REST (HTTP)[JSON] 与服务器通信。

我正在使用 role-based access control管理通话。

示例:[显式 URL 将保持不变]

• 匿名 -> 请求 \
• 服务器 -> 路由到登录表单:\login\
• 用户(现在有了 cookie!)-> 请求 \
  • if (user->role == "manager") return "\manager-homepage\";
  • else return "\homepage\";

由于 REST 是无状态的，我将如何管理这个用例？

我是否在每次请求时都发送 cookie，返回的 HTTP 状态代码会告诉 JS 路由到哪里？

[这会相当低效 + 容易受到 MITM 攻击]

Answer 1

能不能不用标准的认证方案，比如http digest ？

示例:[来自维基百科页面]

• The client asks for a page that requires authentication but does not provide a username and password. Typically this is because the user simply entered the address or followed a link to the page.
• The server responds with the 401 "client-error" response code, providing the authentication realm and a randomly-generated, single-use value called a nonce.
• At this point, the browser will present the authentication realm (typically a description of the computer or system being accessed) to the user and prompt for a username and password. The user may decide to cancel at this point.
• Once a username and password have been supplied, the client re-sends the same request but adds an authentication header that includes the response code.
• In this example, the server accepts the authentication and the page is returned. If the username is invalid and/or the password is incorrect, the server might return the "401" response code and the client would prompt the user again.

Note: A client may already have the required username and password without needing to prompt the user, e.g. if they have previously been stored by a web browser.

另请参阅对一个非常相似的问题的回答:REST and authentication variants

根据您所需的安全级别，您可以通过 ssl 提供全部服务。这将防止 mitm 攻击。