Authlogic、注销、凭证捕获和安全
好吧，这有点奇怪。我今天在我的 Rails 应用程序中安装了 authlogic-oid。一切都工作得很好，但有一点小麻烦。
这就是我所做的：
我首先使用我的 google openid 注册。成功登录、重定向和我的电子邮件以及正确的 openid 都存储在我的数据库中。我很高兴一切顺利！
现在，当我注销时，我的 Rails 应用程序像往常一样破坏会话并将我重定向回我的根 URL，我可以在其中再次登录。现在，如果我尝试登录，它仍然会记住我上次的登录 ID。这不是一个大问题，因为我总是可以“以不同的用户身份登录”，但我想知道是否有办法不仅可以从我的应用程序注销，还可以从谷歌注销。
我注意到堆栈溢出的 openid 身份验证系统也有同样的情况。
你可能会问，为什么我对此如此烦恼。但是，如果您的网络应用程序最终用户（碰巧在网吧里）认为他已经从您的应用程序注销，因此从他的谷歌帐户注销，但后来才意识到他的谷歌帐户已被某些人黑客入侵，这不是一个坏主意吗？一个不值得的失败者，他碰巧注意到他之前的那个人没有从谷歌注销并说..更改了他的密码！
我应该偏执吗？这不是实施 openid 规范时的一个重大安全漏洞吗？也许今天有人可以给我解决这个问题的方法，并且问题已经为我解决了。但是那些在应用程序中实现了 openid 但没有实现解决方法的其他人呢？
Ok this is something weird. I got authlogic-oid installed in my rails app today. Everything works perfectly fine but for one small nuisance.
This is what i did:
I first register with my google openid. Successful login, redirection and my email, along with my correct openid is stored in my database. I am happy that everything worked fine!
Now when i logout, my rails app as usual destroys the session and redirects me back to my root url where i can login again. Now if i try to login it still remembers my last login id. Not a big issue as i can always "Sign in as a different user" but i am wondering if there is anyway to not only logout from my app but also logout from google.
I noticed the same with stack overflow's openid authentication system.
Why am i so bothered about this, you may ask. But is it not a bad idea if your web apps end user, who happens to be in a cyber cafe, thinks he has logged out from your app and hence from his google account only to realize later that his google account had got hacked by some unworthy loser who just happened to notice that the one before him had not logged out from google and say.. changed his password!!
Should i be paranoid? Isn't this a major security lapse while implementing the openid spec? Probably today someone can give me a workaround for this issue and the question is solved for me. But what about the others who have implemented openid in their apps and not implemented a workaround?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果这对您来说是一个大问题，请不要使用 OpenID，或者在成功注销后显示 DHTML 弹出窗口，提醒用户他们的会话在 OpenID 提供商上仍然有效。
至于 Google 的 OpenID，您可能可以做的是通过
http://www.google.com/accounts/ClearSID?continue=http%3A%2F% 2Fwww.google.com%2Faccounts%2FLogout%3F继续%3Dhttp%3A%2F%2Fwww.google.com%2F
If this is such a big issue to you, do not use OpenID, or display a DHTML popup after a successful log out reminding the users that their session is still valid on their OpenID provider.
As for Google's OpenID, what you can probably do is redirect users through the following URL after
http://www.google.com/accounts/ClearSID?continue=http%3A%2F%2Fwww.google.com%2Faccounts%2FLogout%3Fcontinue%3Dhttp%3A%2F%2Fwww.google.com%2F
Afaik，您无法将用户从另一个系统中的帐户中注销。您的应用程序应该只负责它自己的业务。作为一名用户，如果使用 openid 的网站可以让我退出我的 Google 帐户，我会感到非常惊讶。
是的，有一种情况是，用户可以认为他们已经从谷歌注销了，因为他们在您的网站上注销了，但这将（并且应该）是他们自己的错误。
Afaik, there is no way you can log the user out of their account in another system. Your app is supposed to be responsible only for it's own business. As a user, I'd be very surprised if a website using openid could log me out of my google account.
Yes, there is a scenario that a user can assume that they are logged out of google because they logged out on your site but that would (and should) be their own fault.