通过 https 使用 GWT 和 GAE 进行安全身份验证？
我想在我的 appengine 应用程序中实现自定义用户身份验证系统。我不想使用会话。我是这个领域的新手，所以我有两个基本问题：
1：通过 https 为每个 RPC 发送用户名和密码是否安全？我需要做什么才能确保客户端的用户名和密码安全？
2：如何告诉 GWT 在发出请求时使用 https？
我对安全了解不多，所以请不要向我透露任何“明显”的细节。
谢谢！
I want to implement a custom user authentication system in my appengine app. I don't want to use sessions. I'm a newbie in this area, so I have two basic questions:
1: Is it secure to just send a username and password with every single RPC over https? What do I need to do to keep that username and password secure on the client end?
2: How do I tell GWT to use https when it makes its requests?
I don't know much about security, so please don't spare me any "obvious" details.
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
在 GAE 上，您还可以使用 Google User Services API http://code。 google.com/appengine/docs/java/users/overview.html。它非常直观，您无需了解安全详细信息。
On GAE you can also use Google User Services API http://code.google.com/appengine/docs/java/users/overview.html . It's very intuitive and you won't need to know security details.
使用 firebug 观察该过程表明，所有 RPC 都是通过请求主机页面的同一协议发生的。这似乎是同站点源规则所必需的，所以我假设我的答案是
1：是的，但速度较慢
2：当通过 https 请求主机页面时，GWT 自动使用 https
Watching the process with firebug shows that all RPCs are happening over the same protocol that the host page was requested with. This seems to be required for same-site-origin rules, so I'm going to assume that my answers are
1: Yes, but it's slower
2: GWT automatically uses https when the host page was requested w/ https