Gmail 安全架构
我正在尝试了解 gmail 的身份验证机制。 我知道它在登录期间使用 https 来传输用户凭据，然后其余的通信通过 http 进行。 这是如何实现的？ 是否在初始会话期间通过 https 交换某种密钥并在后续请求中使用？ 如果是，某种密钥协商协议（例如 Diffie-Hellman）是否比 https 更适合交换共享密钥？
I am trying to understand gmail's authentication mechanism. I know it uses https for transporting the user credentials during login and then the rest of the communication happens over http. How is this achieved? Is some kind of key exchanged during the initial session over https and used in subsequent requests? if yes, Isn't some kind of key agreement protocol (e.g. Diffie-Hellman) better for exchanging the shared key instead of https?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
https 使用非对称加密来获取对称密钥。 使用 https 设置 cookie 后，它们是通过 http 进行身份验证的来源。 除非用户已设置始终使用 https
https uses asymmetric encryption to obtain a symmetric key. After cookies are set using https they are the source of authentication over http. Unless the user has set https to be always used