不同域上的跨站点身份验证选项
我们正在考虑为一个非常临时的网站设计一个身份验证系统，该网站需要从另一个站点进行身份验证。总而言之，我们有两个位于完全不同域的站点。 foo.com 是始终存在（并且已经存在）的主要站点。这是用户登录该站点并在登录状态下执行操作的主要位置。该网站将很快进行修改，以提供指向 bar.com 的链接。当登录 foo.com 的用户单击 bar.com 的链接时，他们需要神奇地登录到 bar.com。 （我知道这听起来像是一场安全噩梦，但 bar.com 只是一个短窗口的临时站点，foo.com 上的人们将使用该站点一两天）。我们不允许人们登录 bar.com，这一切都必须发生在 foo.com 上。我们已经尝试在这里找出解决方案，如果有好的解决方案，我们希望提供更多解决方案。他是我们的：
在 bar.com 上，检查引荐来源网址，如果是 foo.com，则让用户登录。这是非常不安全的，很容易被欺骗。我们知道。
登录 foo.com 时，指向 bar.com 的链接有一个特殊的加密查询字符串，代表用户在 foo.com 上的会话。当单击 bar.com 的链接时，让 bar.com 获取该查询字符串并使用 Web 服务将其传递回 foo.com，foo.com 将响应该查询字符串，无论该会话是否合法。这比上面的 1 更安全，因为查询字符串会话信息已加密，并且 Web 服务调用可确保其合法会话。
这里还有其他选择吗？让我重申一下，我们想要一个比上面的解决方案更安全的好解决方案，但这是一个只有某些人才能访问的临时站点。我们知道这听起来像是一个奇怪的安排，但它是针对一个非常特定的网站，由于特定的目的，该网站的生命周期很短。根据要求，我们需要用户仅登录原始站点。预先感谢您对此的任何提示或指示。
We're considering an authentication system for a very temporary website that needs to authenticate from another site. To sum it up here, we have two sites on completely different domains. foo.com is the main site that will always exist (and already does). This is the main place where users go and log into that site, and do things in their logged in state there. That site will get modified soon to have a link to bar.com. When a user that's logged in on foo.com clicks the link to bar.com they need to be magically logged into bar.com. (I know this sounds like a security nightmare but bar.com is just a temporary site for a short window that people on foo.com will be using for a day or two). We are not allowed to log people in on bar.com, it must all happen on foo.com. We've tried to figure out solutions here and want some more if there are any good ones. He are ours:
On bar.com, check the referrer, if its foo.com, make the user logged in. This is very insecure and can easily be spoofed. We know.
When logged in on foo.com, have the link to bar.com have a special encrypted query string that represents the user's session on foo.com. When the link is clicked to bar.com, have bar.com take that query string and use a web service to pass it back to foo.com, for which foo.com will respond whether or not that's a legit session or not. This is more secure than 1 above because the query string session info is encrypted and the web service call makes sure its a legit session.
Are there any other options here? Let me re-iterate that we'd like a good solution that's more secure that 1 above but this is for a temporary site that only certain people will have access to. We understand it sounds like an odd arrangement but its for a very specific site that will have a short life for a specific purpose. Per requirements, we need users to log into only the originating site. Thanks in advance for any tips or pointers on this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我敢说选项 2 是您最好的选择，因为：
跨域 SSO（单点登录）的良好示例：第 1 部分 & 第 2 部分
I would venture to say that option 2 is your best bet, given that:
Good example of SSO (Single Sign-On) across domains: Part 1 & Part 2
我认为第二个选项是一个很好的解决方案，您甚至可以在没有网络服务的情况下进行：使 bar.com 的链接包含包含用户名（或用户需要的任何上下文）、随机数（例如随机数）的查询参数)、以及由用户名、用户的IP地址和随机数串联而成的认证码(例如HMAC或数字签名)。那么两台服务器之间就不需要进行通信了，只需要预先共享验证数据（HMAC密钥/签名验证公钥），就可以直接在第二台服务器上验证信息了（记下曾经使用过的信息）防止重放攻击的随机数，但是我猜它们在您的场景中可能不是一个大问题）。
I think the second option is a good solution, you could even do without the web service: Make the link to bar.com include query parameters containing the username (or whatever context you need for the user), a nonce (e.g. a random number), and an authentication code (e.g. a HMAC or a digital signature) of a concatenation of the username, the user’s IP address, and the nonce. Then, you do not need to communicate between the two servers, you only need to preshare the verification data (HMAC key/signature-verification public key), and you can verify the information directly on the second server (keeping note of once-used nonces to prevent replay attacks, however they are probably not a great concern in your scenario, I guess).