Make a summary every day, persistence is victory!

/** @date 2021-07-01 @description */Copy the code

One (sequence)

  1. For determining whether the user really has access to the systempermissions, need to check the user’s own knowledge or user’s own information, general information includes:
A. Password: a string known only by the user B. Dynamic token: one-time information only available on the device owned by the user C. D. Biometric authentication: iris or fingerprint. E. IC card: personal information onlyCopy the code
  1. HTTP/1.1 Uses the following authentication modes:
A. BASIC AUTHENTICATION B. DIGEST authentication C. SSL client authentication D. FormBase authenticationCopy the code
  1. BASIC authentication,Use a few

4. DIGEST AuthenticationUse a few 5. SSL client authentication: By defaultHTTPStheClient Certificate6. SSL client authentication Procedure: To achieve SSL client authentication, distribute the client certificate to the client in advance and install the certificate on the clientcost

1. After receiving a Request for authentication resources, the server sends a Certified Request packet, asking the client to provide a certificate. 2. After selecting a Client certificate to be sent, the user sends the Client certificate information to the server in a Client Certified packet. 3. After the client certificate is successfully authenticated, the server obtains the public key in the client certificate and starts HTTPS communicationCopy the code
  1. The SSL client authentication is usedTwo-factor authentication: The certification process is not only requiredpasswordThis factor also needs to be provided by the applicant for certificationOther informationIn other words, except useClient CertificateTo authenticate the client, you also need topasswordTo make sure it is the user himself
  2. Based on theForms authentication: Sent from the client to the serverLogin information, based on the verification results of login information (such as Gmail login)
  3. Authentication is mostly based on form authentication (i.e. login by entering a user name/password)
  4. useCookieTo manage theSession:
The client logs in using the user name and password. 2. The server issues a SessionID to identify the user and writes the SessionID in the header set-cookie field when it returns a response to the client. After receiving the SessionID, the client saves it as a Cookie. When sending a request again, the client automatically sends the Cookie. At this time, the server can identify the user and its status according to the received SessionIDCopy the code

11. Password with saltHash: The server generates a segmentrandomtheIs long enoughString, with passwordcombinationForm a hash value, and then save it so that even if two users have the same password, it will be becausesaltThe difference in hash values can be greatly reducedPassword feature, it is difficult for attackers to use their own password signature databasecrack