如何改进 HTTP 基本身份验证？
我目前正在开发一个基于 Zend Framework 的 API 站点。由于 ZF 对摘要式身份验证没有足够的支持，而且现在转向另一个框架为时已晚，因此我正在考虑实施基本身份验证。
Basic 和 Digest 实际上并不是执行身份验证的理想方式，Digest 更好，但不幸的是 Zend 不太支持（正确实现它需要太多工作，需要尽快完成项目）。基本身份验证的一大问题是密码以明文形式发送。我在想，我可以不以明文形式发送密码，而是使用单向散列算法/bcrypt 对它进行散列，以避免以明文形式发送密码吗？但它仍然遭受中间人攻击。
但是，如果将基本身份验证与当前大多数 Web 应用程序使用的基于表单的身份验证进行比较，它们在将请求传输到服务器时是否都存在相同的安全问题？
I am currently working on a API site based on Zend Framework. As ZF doesn't have sufficient support for Digest Authentication and it is too late to shift to another framework now, I am thinking of implementing Basic Authentication.
Basic and Digest are not actually the ideal way to perform authentication, while Digest is better but unfortunately not quite supported by Zend (implementing it properly will take too much work, need the project done asap). One of the big problem with Basic auth is that password is sent in cleartext form. I am thinking instead of sending the password in cleartext form, can I somehow hash it using one-way-hashing algorithm / bcrypt to avoid sending password in cleartext form? But it is still suffering from man-in-the-middle attack though.
But if comparing the basic authentication with current form-based authentication used by most web-apps, are they both sharing the same security problem while transferring the request to the server?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
确保请求安全的最佳选择是对身份验证请求使用 SSL，以确保信息不会以明文形式发送。
如果您在发送身份验证请求之前尝试在客户端上进行某种哈希或加密，则会立即向恶意用户暴露您的哈希算法和可能使用的任何盐。这使得他们可以对您的服务器使用字典攻击。
绝对是。同样，对于基于表单的身份验证，您最好的选择是使用 SSL。
或者，您可以考虑使用外部身份验证服务，例如 OAuth。
Your best option for keeping the request secure is to use SSL for your authentication requests to ensure that the information isn't sent in plaintext.
If you try to do some kind of hashing or encryption on the client before sending the authentication request, you immediately expose your hashing algorithm and any salts you might be using to malicious users. This makes it possible for them to use dictionary attacks against your server.
Absolutely they are. Again with forms based authentication your best bet is to use SSL.
Alternatively, you might consider using an external authentication service like OAuth.
嗯，Zend Framework 有一个用于身份验证的摘要适配器吗？
手册：Zend Digest 身份验证
Hum, Zend Framework has an Digest Adapter for Authentication?
Manual: Zend Digest Authentication
您始终可以编写自己的
Zend_Auth_Adapter来进行 HTTP 身份验证。我实现了Zend_Auth_Adapter_Http_Resolver_Interface，每天都有不同的密码，格式为默认密码+日期+月份。效果就像一个魅力！You could always write your own
Zend_Auth_Adapterfor HTTP authentication. I implementedZend_Auth_Adapter_Http_Resolver_Interfaceto have different passwords each day in the format of default password + day + month. Works like a charm!