本文的示例代碼參考JWTBasic
目錄
什么是JWT
JSON Web Token (JWT)
is an open standard (RFC 7519)
that defines a compact and self-contained way
for securely transmitting information between parties
as a JSON object
JWT的結(jié)構(gòu)
JWT = Payload + Header + Signature
Payload
Payload = base64_encode(JSON Content)
vim payload.js
var content = {
"sub": "3252",
"name": "Test",
"iat": 1528516800,
"exp": 1528603200
};
var buffer = new Buffer(JSON.stringify(content));
var payload = buffer.toString('base64');
console.log(payload);
node payload.js
eyJzdWIiOiIzMjUyIiwibmFtZSI6IlRlc3QiLCJpYXQiOjE1Mjg1MTY4MDAsImV4cCI6MTUyODYwMzIwMH0=
Header
Header = base64_encode(JSON Content)
vim header.js
var content = {
"typ": "JWT",
"alg": "HS256"
};
var buffer = new Buffer(JSON.stringify(content));
var header = buffer.toString('base64');
console.log(header);
node header.js
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9
Signature
vim signature.js
var payload = new Buffer(JSON.stringify({
"sub": "3252",
"name": "Test",
"iat": 1528516800,
"exp": 1528603200
})).toString('base64');
var header = new Buffer(JSON.stringify({
"typ": "JWT",
"alg": "HS256"
})).toString('base64');
var algo = require('jwa')("HS256");
var secret = 'mystar';
var signature = algo.sign(header + '.' + payload, secret);
console.log(signature);
var jwt = header + '.' + payload + '.' + signature;
console.log(jwt);
cnpm i --save jwa
node signature.js
-C46PmPVQZt8hCEy0RQ8bmB0jzwXOx4FHw7Yqx8WA7w
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIzMjUyIiwibmFtZSI6IlRlc3QiLCJpYXQiOjE1Mjg1MTY4MDAsImV4cCI6MTUyODYwMzIwMH0=.-C46PmPVQZt8hCEy0RQ8bmB0jzwXOx4FHw7Yqx8WA7w
HS256 = HMAC (哈希安全消息驗(yàn)證碼) + SH256 (安全哈希算法) 更多參考 web安全 之 存儲(chǔ)密碼 & PHP開發(fā) 之 摘要和簽名
JWT與Session
JWT安全基于服務(wù)器簽名+HTTPS
JWT信息經(jīng)過base64編碼很容易解碼 所以信息不會(huì)加密 只能通過簽名防篡改
JWT信息并不會(huì)加密 所以必須使用HTTPS來加密通信過程 否則信息會(huì)完全泄露
JWT存儲(chǔ)在客戶端而Session存儲(chǔ)在服務(wù)器
JWT存儲(chǔ)在客戶端 可以緩解服務(wù)器Session存儲(chǔ)壓力
JWT存儲(chǔ)在客戶端 便于水平擴(kuò)展實(shí)現(xiàn)單點(diǎn)登錄(SSO)等 但是 Session可以通過Redis等共享解決類似問題
JWT存儲(chǔ)在客戶端 且包含有效期 所以服務(wù)器難于控制數(shù)據(jù)過期
JWT的應(yīng)用場(chǎng)景
JWT可以防止CSRF攻擊
關(guān)于CSRF攻擊 更多參考 Web安全 之 CSRF攻擊 & Laravel框架 之 CSRF
JWT可以應(yīng)用于簽名場(chǎng)景
生成重置密碼url
審批人身份驗(yàn)證
JWT可以應(yīng)用于簡(jiǎn)單鑒權(quán)
關(guān)于JWT鑒權(quán) 更多參考 JWT vs OAuth authentication & OAuth 2和JWT - 如何設(shè)計(jì)安全的API？
