rnn 简要

There are many vulnerabilities in web. MySpace suffered from XSS(Cross Site Scripting). Twitter has suffered many data leaks. But data leaks is something that can be prevented as well as protected with many restrictions.Security and authentication on server or client has always been a major concern to web security.And adding client side security has been better option nowadays.

网络中存在许多漏洞。 MySpace遭受了XSS(跨站点脚本)的困扰。 Twitter遭受了许多数据泄漏。 但是数据泄漏是可以防止的并且可以受到许多限制的保护。服务器或客户端的安全性和身份验证一直是Web安全的主要问题。如今，增加客户端安全性已成为更好的选择。

Authentication is the major factor for the security in any web or mobile applications. Authentication make our website secured against various vulnerabilities.It is also important to preserve many data for security purpose.

身份验证是任何Web或移动应用程序中安全性的主要因素。 身份验证使我们的网站免受各种漏洞的侵害，出于安全目的保留许多数据也很重要。

There are many types of authentication. But basically, they are classified into 2 types.They are:

身份验证有多种类型。 但基本上，它们分为两种类型：

1.状态验证。 (1. Stateful Authentication.)

We can take back the authentication an session on IDP (Internet Provider) any time.It is used for applications that do not require scalability too much and do not occupy much memory space.

我们可以随时在IDP(Internet Provider)上通过会话恢复身份验证。它用于不需要太多可伸缩性并且不占用太多内存空间的应用程序。

Working

加工

Firstly most of the authentication are created in backend portion.And the corresponding session id is sent to the client.Each time the client makes a request to the server, the server locates the session memory using the reference Id from the client and finds the authentication information.

首先大多数身份验证是在后端部分创建的，并将相应的会话ID发送到客户端，每次客户端向服务器发出请求时，服务器都会使用客户端的引用ID定位会话内存并找到身份验证信息。

Kenneth Choi) Kenneth Choi的照片)

In this authentication,as the number of logged-in users increases, the more server resources are occupied.It is not possible for scaling.It is difficult for third party to use credentials. To overcome its features, Stateless authentication has come into practice.

在此身份验证中，随着登录用户数量的增加，将占用更多的服务器资源。无法进行扩展。第三方很难使用凭据。 为了克服其功能，无状态身份验证已付诸实践。

2.无状态认证 (2. Stateless Authentication)

The session expiration time is set when authentication token in made. We can take back the authentication an session on IDP (Identity Provider) any time.

会话到期时间是在制作认证令牌时设置的。 我们可以随时在IDP(身份提供商)上通过会话收回身份验证。

Working

加工

Stateless authentication stores the user session data on the client side (browser). And the data is authenticated by the server.The data is signed by the key of Identity Provider to ensure the integrity and authority of the session data.Identity Provider is used to create and manage information of identity and provides authentication .

无状态身份验证将用户会话数据存储在客户端(浏览器)上。 并且数据由服务器进行身份验证。数据由身份提供商的密钥签名以确保会话数据的完整性和权威性。身份提供商用于创建和管理身份信息并提供身份认证。

Kenneth Choi) Kenneth Choi )

In this authentication,as the number of logged-in users increases, the server resources remains same as the key is renewed over time.It is possible for scaling.It is difficult for third party to use credentials.It is currently used widely. The most popular of it is JWT(JSON Web Token).It cannot revoke session any time. And it is more complex for solving.

在此身份验证中，随着登录用户数量的增加，服务器资源将保持不变，并且密钥随着时间的推移而更新。它可以扩展。第三方很难使用凭据。目前，它被广泛使用。 其中最流行的是JWT(JSON Web Token)。它无法随时撤消会话。 而且解决起来比较复杂。

Many of you get confused with the term called IDP(Identity Provider).We will talk about it.

你们中的许多人都对称为IDP(Identity Provider)的术语感到困惑，我们将对此进行讨论。

Why token based authentication stateless?

为什么基于令牌的身份验证是无状态的？

Token-based authentication can be used to enable a stateless architecture but can also be used in stateful architectures. For example, a JWT can contain all the necessary session data, encoded directly into the token, in which case it supports a stateless architecture. JWT can also be used to simply store a reference or ID for the session, in which case the session data needs to be stored server-side, making the architecture stateful.

基于令牌的身份验证可以用于启用无状态架构，但也可以在有状态架构中使用。 例如，JWT可以包含直接编码到令牌中的所有必要会话数据，在这种情况下，它支持无状态架构。 JWT还可以用于简单地存储会话的引用或ID，在这种情况下，会话数据需要存储在服务器端，从而使体系结构有状态。

Identity Provider

身份提供者

It is simply used to provide authentication and offers maintenance and provides environment for web and various related features.

它仅用于提供身份验证和维护，并为Web和各种相关功能提供环境。

According to wikipedia.

根据维基百科。

Identity Provider (IdP or IDP)is a system entity that creates, maintains, and manages identity information for principals while providing authentication services to relying applications within a federation or distributed network

身份提供者(IdP或IDP)是一个系统实体，可为主体创建，维护和管理身份信息，同时向联合或分布式网络中的依赖应用程序提供身份验证服务

It is majorly responsible for providing web the basic identity and various security features.

它主要负责为Web提供基本身份和各种安全功能。

It is of 3 types:

它有3种类型：

1.IndieAuth Identity Provider

1.IndieAuth身份提供者

2.OpenID provider

2.OpenID提供者

3.SAML identity provider

3.SAML身份提供者

HTTP(HTTP)

HTTP stands for Hyper Text Transfer Protocol.It is a application layer protocol that allows the communication between client and server.HTTP is also stateless.

HTTP代表超文本传输​​协议，它是允许客户端和服务器之间通信的应用层协议，HTTP也是无状态的。

Every time you get to the new link, the protocol looses everything(your login data). For example,if you login and get redirected to you home page in any site. If you move to any other pages of website,it looses your identity that you have (like username,password while logging in). That is where cookie comes in to remind your data to the protocol.

每次访问新链接时，协议都会丢失所有内容(您的登录数据)。 例如，如果您登录并重定向到任何站点中的主页。 如果您移至网站的任何其他页面，则会失去您的身份(例如登录时的用户名，密码)。 这就是cookie进入的地方，以提醒您使用协议的数据。

Remember HTTP and HTTPs are different

记住HTTP和HTTP是不同的

HTTPs where s stands for secure for any connection.It allows better security than HTTP and is in use nowadays.

HTTP，其中s表示任何连接的安全性。它提供比HTTP更好的安全性，并且目前正在使用。

曲奇饼 (Cookie)

Cookie is a file or part of file that is used for storing the temporary data on your local computer. It is basically a short and quick memory to remind HTTP about something that is stored and is necessary until user is active in the website.

Cookie是用于在您的本地计算机上存储临时数据的文件或文件的一部分。 从本质上讲，它是一种简短的记忆，可以提醒HTTP有关已存储的内容，并且在用户活跃于网站之前是必需的。

基于会话的身份验证 (Session based Authentication)

It is a authentication based on session.In this, the data is stored on cookie.Cookie is something that is used for storing the data on local computer.Cookies stores the id of the session and sends the data to the user browser.Then the browser puts the request to get the authentication.

这是一种基于会话的身份验证，其中数据存储在cookie上，Cookie用于将数据存储在本地计算机上，Cookies存储会话的ID并将数据发送到用户浏览器。浏览器发出请求以获取身份验证。

JSON格式 (JSON)

It is the secutiry that has JSON token in it.JSON stands for Javascript Object Notation.It is simply a format for the representation of the data.Its example is given by:

它是带有JSON令牌的安全性.JSON代表Javascript Object Notation，它只是一种数据表示形式的格式，其示例如下所示：

{“First_name”:”Aakash”,“Middle_name”:”Raj”,“Last_name”:”Dhakal”}

In the following, first name are just the attributes and item after colon is the value.

在下面，名字只是属性，冒号后面的项目是值。

JSON web token creates a token of JSON to create a gateway or the temporary key for the web access inside the site.

JSON Web令牌创建JSON令牌，以创建站点内Web访问的网关或临时密钥。

JSON Web令牌(JWT) (JSON Web Token(JWT))

JWT offers a basic authentication in your web.It is a stateless authentication method that creates a token temporarily for a accessing a website.We can say it as a temporary lock for a login system to prevent unauthorized access.

JWT在您的Web中提供基本身份验证，这是一种无状态身份验证方法，可为访问网站临时创建令牌，我们可以说它是登录系统的临时锁，可防止未经授权的访问。

JWT consists of 3 parts concatenated with . like

JWT由与串联的3部分组成。 喜欢

header_part.payload_part_signature_part//actually each part consists of combinations of alphabets and numbers (like X124ddfe) Header

标头

It describes the type of token and signing algorithm being used.

它描述了令牌的类型和所使用的签名算法。

2.Payload

2.有效载荷

It consists of data or identities of user information within it.

它由数据或其中的用户信息标识组成。

3.Signature

3.签名

It consists of the encoded header, the encoded payload, a secret, and lastly, the algorithm which is specified in the header.

它由编码的标头，编码的有效载荷，机密以及最后在标头中指定的算法组成。

To create a JWT authentication we need to create it through 2 functions

要创建JWT身份验证，我们需要通过2个函数来创建它

jwt.sign()

jwt.sign()jwt.verify()

jwt.verify() //import jwt const jwt=require(‘jsonwebtoken’); //Simply to create token const token=jwt.sign({_id:’abc123},’secretkey’,{expiresIn:’7days’}); console.log(token); //Get data from token const data=jwt.verify(token,’secret-key’); console.log(data); //NOTICE:Did you notice that the secret-key is same in both the cases.It is a key to verifyLearn more about it at jwt.io

Bcryptjs (Bcryptjs)

Bcryptjs offers a good way of hashing your password. It is used to completely encrypt your password that no any other (not even the developer are allowed to view the password until the proper decoding method is cracked). Bcryptjs is a great security tool to ensure the proper security to your password.It uses a method called hashing to get the encrypted password.To again get the password the same hashing is done to ensure the correct password.

Bcryptjs提供了一种哈希密码的好方法。 它用于完全加密您的密码(没有其他密码(在破解正确的解码方法之前，甚至不允许开发人员查看密码))。 Bcryptjs是一种很好的安全工具，可确保密码的正确安全性，它使用一种称为哈希的方法来获取加密的密码。要再次获取密码，请执行相同的哈希操作以确保密码正确。

To Register: Create Hashed PasswordTo Login:Hashed the re-entered password with the same hashing to match the previous hashed password

There are some tools that we need to know what its component are

我们需要一些工具来了解其组成部分

Hashing

散列

Hashing is the method to taking a data to encode into something with a set of rules.It is done using a hash function.

散列是一种通过散列函数获取数据以将其编码为某些规则的方法。

Wikipedia defines hash function as

维基百科将哈希函数定义为

A hash function is any function that can be used to map data of arbitrary size to fixed-size values. The values returned by a hash function are called hash values, hash codes, digests, or simply hashes.

散列函数是可以用于映射到固定大小的值任意大小的数据的任何功能。 哈希函数返回的值称为哈希值，哈希码，摘要或哈希。

Hash function index a code to a table by a certain rule that generates a unique set of code.

哈希函数按照一定的规则将代码索引到表中，该规则生成一组唯一的代码。

Its basics function is done by:

它的基本功能是通过以下方式完成的：

bcrypt.genSalt()bcrypt.hash()

Its code structure is given below.

其代码结构如下。

//import bcryptjsconst bcrypt = require('bcryptjs');bcrypt.genSalt(10, function(err, salt) { bcrypt.hash("B4c0/\/", salt, function(err, hash) { // Store hash in your password DB. });});

genSalt is a keyword that is used to generate the salt for the hashing.The sal obtained is used for hashing with ‘bcrypt.hash’. 10 is a number used in hashing for the number of times hashing functions hashes a particular input.

genSalt是用于生成哈希盐的关键字。获得的sal用于通过'bcrypt.hash'进行哈希。 10是散列中用于散列函数散列特定输入的次数的数字。

To check a password:

要检查密码：

// Load hash from your password DB.bcrypt.compare("B4c0/\/", hash, function(err, res) { // res === true});bcrypt.compare("not_bacon", hash, function(err, res) { // res === false});bcrypt.compare("B4c0/\/", hash).then((res) => { // res === true});

Learn more at https://github.com/dcodeIO/bcrypt.js/

进一步了解https://github.com/dcodeIO/bcrypt.js/

护照 (PassportJWT)

PassportJWT is a starategy for authentication JSON Web Token(commonly known as JWT).It claims to offer 500+ authentication in your web including google,facebook, etc

PassportJWT是身份验证JSON Web令牌(俗称JWT)的繁星点点，它声称在您的网络中提供500多种身份验证，包括google，facebook等

It is created as :

它创建为：

new JwtStrategy(options, verify)

option is simply an object containing options to control how the token is extracted from the request or verified.

option只是一个对象，其中包含用于控制如何从请求中提取令牌或验证令牌的选项。

verify is a function with the parameters(jwt_payload,done)

验证是否具有参数(jwt_payload，done)的函数

payload is a programming term used to denote that it consists of some information about that topic.Strategy carries out the strategies for passport.(maybe..)

有效载荷是一个编程术语，用于表示它包含有关该主题的一些信息。策略执行护照策略。(也许..)

We have secret key in passportjwt called SecretOrKey(can be of any name as it is not keyword but official documentation uses this word to denote) for storing a access for the passport.

我们在passwordjwt中有一个称为SecretOrKey的秘密密钥(可以使用任何名称，因为它不是关键字，但是官方文档使用此词来表示)，用于存储护照的访问权限。

just basic format is

只是基本格式是

passport.use(new JwtStrategy(opts, function(jwt_payload, done) {}

It is used with 3 coding setups(for passport.js file)

它与3种编码设置一起使用(用于password.js文件)

const JwtStrategy = require('passport-jwt').Strategy,const ExtractJwt = require('passport-jwt').ExtractJwt;//opts has 2 objectsvar opts = {}opts.jwtFromRequest = ExtractJwt.fromAuthHeaderAsBearerToken();opts.secretOrKey = 'secret';passport.use(new JwtStrategy(opts, function(jwt_payload, done) { User.findOne({id: jwt_payload.sub}, function(err, user) { if (err) { return done(err, false); } if (user) { return done(null, user); } else { return done(null, false); } });}));

jwtFromRequest is a local term(like secretOrKey as stated above) that is use to get data from header authorization. The most preferred way to get the token is by using in the form

jwtFromRequest是一个本地术语(例如如上所述的secretOrKey)，用于从标头授权中获取数据。 获取令牌的最优选方法是使用形式

Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjVmNWNlODQxOTA2NGU3MmQ0MmVlZDQ0YiIsIm5hbWUiOiJBYWthc2giLCJhdmF0YXIiOiIvL3d3dy5ncmF2YXRhci5jb20vYXZhdGFyLzI2NjI0MWE5YzRlMjRjNGEwODJjYTBlYWI5ZjUxOGEzP3M9MjAwJnI9cGcmZD1tbSIsImlhdCI6MTYwMDEzNTM2MCwiZXhwIjoxNjAwMTM4OTYwfQ.WUG8XD9WjK7rs9-w4yPh-XL5mzsY2PxzTG8WS4fbmOc

The random strings that appears after bearer is a token(imagine anyone remembering to get access).

承载后出现的随机字符串是一个令牌(想象任何想记住要访问的人)。

There are other way to extract the header too, but I really don’t know why the format of using Bearer is used for the token representation.

还有其他提取标头的方法，但我真的不知道为什么将使用Bearer的格式用于令牌表示。

For any route file

对于任何路由文件

//import passportconst passport = require('passport');router.get('/any', passport.authenticate('jwt'{session:false}),(req, res) => { //can be anything});

And at last,setup the server file

最后，设置服务器文件

// Passport middlewareapp.use(passport.initialize());// Passport Configrequire(‘./config/passport’)(passport);

Learn more from http://www.passportjs.org/packages/passport-jwt/

从http://www.passportjs.org/packages/passport-jwt/了解更多

翻译自: https://medium.com/@rajdhakal/authentication-in-brief-a95b4ed91ed5

rnn 简要

相关资源：双向RNN:bidirectional_dynamic_rnn()函数的使用详解