联合身份验证令牌保存在哪里 [WIF STS]？
当我开始探索 WIF 时，我对以下内容有疑问：
在 Windows Identity Foundation[WIF] 中，查看安全令牌服务[STS]，我想知道联合身份验证令牌在哪里正在被拯救吗？
我认为它在浏览器 cookie 中，如果是的话，有人可以给我一个见解吗？
While i started to explore WIF, i have a doubt on the following:
In the Windows Identification Foundation[WIF],looking on to Security Token Service[STS], i wish to know where the federation authentication token is being saved?
I think its in browser cookie, if so can anyone please give me a insight about it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我使用“Fiddler”Web 调试器来找到这个问题的答案。发生的情况如下：假设您的应用程序名称为
SecureApp，STS 的名称为SecurePortal。当您将浏览器指向
SecureApp时，发生的第一件事是它会检查您是否已通过身份验证。如果没有，您将立即重定向到SecurePortal，并带有一个查询字符串，指示您正在登录SecureApp。使用
SecurePortal登录后，WIF 框架会从SecurePortal生成一个HttpResponse，其中包含一些“隐藏”HTML 字段，其中包含指示您的值已成功登录。这些值可能会根据SecurePortal的设置进行签名和/或加密。与这些值一起写入一些 Javascript 代码，以使浏览器将值发布到SecureApp。一旦这些值被SecureApp验证，框架将编写一个带有 cookie 的HttpResponse来指示您已登录。根据我的经验，cookie 的名称以“FedAuth”开头。此时，您现在可以访问SecureApp中的页面。另外，我想指出，该框架似乎有某种方法可以防止它设置的 cookie 被手动删除。
我建议您使用网络调试器并自行观察这个过程，以便更好地理解。
简短的回答：令牌首先作为 STS 中的
HttpResponse提供给您的浏览器，然后在应用程序中作为 cookie 再次提供给您的浏览器。I used the 'Fiddler' Web debugger to find the answer to this question. Here's what happens: Let's suppose that the name of your application is
SecureAppand the name of your STS isSecurePortal.The first thing that happens when you point your browser at
SecureAppis that it checks to see if you're authenticated. If you're not, you are immediately redirected toSecurePortalwith a query string indicating that you're logging intoSecureApp.Once you log in with
SecurePortal, the WIF framework produces anHttpResponsefromSecurePortalwhich contains some 'hidden' HTML fields containing values which indicate that you successfully logged in. These values may be signed and/or encrypted based on the setup ofSecurePortal. Along with these values is written some Javascript code to make the browser post the values toSecureApp. Once these values are validated bySecureApp, the framework will write anHttpResponsewith cookie(s) that indicate that you are logged in. In my experience, the names of the cookies start with "FedAuth". At this point, you may now access pages withinSecureApp.Also, I would like to point out that the framework seems to have some way of preventing the cookies that it sets from being removed manually.
I suggest that you use a web debugger and observe this process happening on your own to understand better.
The short answer: The token is first given to your browser as an
HttpResponsein the STS and then given to your browser again as a cookie in the application.WIF 还支持令牌的“会话模式”。在这种情况下，令牌保留在服务器中，并且仅将（小得多的）句柄传递给浏览器。如果您有带宽考虑，则特别有用。
请参阅 Vittorio 的帖子：WIF 会话模式
添加了更多参考：
Hervey 的 上次 PDC 会议 也涵盖了这一点。
WIF also supports "Session Mode" for Tokens. In that case, the token is kept in the server and only a (much smaller) handle is passed to the browser. Especially useful if you have bandwidth considerations.
See Vittorio's post on this: Session mode for WIF
Added more references:
Hervey's session at last PDC also covers this.