移动应用程序开发 - HTML5 LocalStorage 与 SessionStorage 与 Cookie
我们正在 jQuery Mobile 平台上开发一个移动 Web 应用程序，需要用户提供用户名和密码。
我们不想每次都要求用户重新输入详细信息，而是只询问他们一次用户名和密码，然后提示他们输入 PIN 码。
我们将加密该 pin 并加密用户标识符字符串，并将两者保存在 LocalStorage 或 Cookie 中。
当用户第二次访问该应用程序时，我们将测试是否可以找到用户标识符，如果可以，则提示他们输入 PIN 码。
输入 PIN 码后，我们将安全地 (SSL) 传递 PIN 码和用户标识符，以便在服务器上进行解密和验证。
我在一些地方读到我们应该使用 Cookie 而不是 LocalStorage（从安全角度来看）。您同意这一点吗？cookie 可以在大多数智能手机上使用吗？
我们还需要确保用户每次关闭浏览器或浏览另一个页面或超过 30 分钟不活动时都需要重新输入 PIN。
为了管理这个问题，我正在考虑在 SessionStorage 中存储一个值，因为我读到这比 LocalStorage 更安全，并且在浏览器关闭时会过期。或者我们可以再次使用 Cookie。
安全性是一个关键问题，因此我很想听听您可能拥有的任何提示和/或替代方法。
提前非常感谢...
We are developing a mobile web application on the jQuery Mobile platform that requires a user to provide their username and password.
Rather than asking the user to re-enter their details each time we want to only ask them once for their username and password and then prompt them to enter a pin.
We will encrypt this pin and encrypt a user identifier string and save both either in LocalStorage or Cookie.
When the user visits the application for a second time we will test if a user identifier can be found and if so prompt them to enter a pin.
Once the pin is entered we will securely (SSL) pass the pin and the user identifier to be decrytped and validated on the server.
I've read in a few places that we should use Cookies instead of LocalStorage (from a security point of view). Would you concur with this and can cookies be used across most smart-phones?
We also need to ensure that the user is required to re-enter their pin each time they close the browser or browse to another page or exceed 30 minutes of inactivity.
To manage this I was thinking of storing a value in SessionStorage as I have read that this is more secure than LocalStorage and expires when the browser is closed. Alternatively we could use Cookies again.
Security is a key concern so I'd be intersted to hear any tips and/or alternative approaches you may have.
Many thanks in advance...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果安全性是您最关心的问题，我不建议使用 cookie，因为它们是随每个请求发送到服务器的，这可能会被通过网络嗅探该流量的任何人拦截。从性能角度来看，使用 cookie 还会增加服务器和客户端之间来回的数据量。
出于您的目的，如果您希望数据仅在浏览器会话的生命周期内持久存在，我会选择
sessionStorage，包括可以测试会话过期的时间戳。sessionStorage和localStorage中的数据仅保留在客户端上，永远不会发送到服务器。If security is your chief concern, I would not recommend using cookies since they are sent with every request to the server, which could potentially be intercepted by anyone sniffing that traffic over the network. Performance-wise, using cookies also increases the amount of data going back and forth between server and client.
For your purposes I would choose
sessionStorageif you want your data to be persistent only for the life of the browser session, including as well a timestamp that you can test for session expiration. Data insessionStorageandlocalStoragestays only on the client and is never sent to the server.