PHP：验证我的 REST 应用程序
我一直在研究使我的 REST 应用程序更加安全的方法。 HTTP 基本身份验证似乎是一种方法，但需要在每次请求时在客户端和服务器之间传送用户名+密码。如果我使用 curl 但使用 Javascript 文件，可以正常工作吗？不太酷。
我最近发现并阅读了有关 Digest HTTP 身份验证的信息，这似乎比 HTTP Basic 提供的安全性迈出了一大步，尽管理解起来要复杂得多，但我仍然没有完全诚实。
我看过这个问题，它的答案可以了解专业人士和使用摘要方法有缺点，但似乎我想得越多，事情就越混乱。
似乎已经有很多可用的解决方案可以解决这个问题，但其中大多数已经存在近 10 年了。
Digest 方法是否是一种恐龙，最好将其留在黑暗中，以采用另一种更新的方法来保护请求，或者是否有任何好的现有 Digest 库可用？
I've been looking into ways of making my REST application a tad more secure. HTTP Basic authentication seems like a way, but with the need of shipping username+password between the client and the server on every request. Could work fine if I used curl, but with a Javascript file? Not so cool.
I've found and read about the Digest HTTP authentication lately which seems to be a big step up from the security HTTP Basic offers, although a lot more complicated to understand, which I still haven't to be completely honest.
I've looked at this question and it's answers to learn about the pro's and con's of using the Digest method, but it appears that the more I think about it, the messier it all gets.
There seems to be plenty of already available solutions out there to solve this issue, however most of them are now close to 10 years of age.
Is the Digest method a dinosour that should be best left alone in the dark for another, newer ways of securing requests, or are there any good already-existing Digest libraries available?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您是否考虑过使用 HTTPS？您真正需要的是域的签名安全证书，并签入您的代码以确保它以这种方式连接。它将以这种方式使用 SSL，服务器和浏览器将自动对来回发送的数据进行加密，并对所有通信使用三向握手。
Have you thought of using HTTPS? All you really need is a signed security certificate for the domain and to check in your code to make sure it connects that way. It will use SSL that way and the server and browser will automatically take care of encrypting the data sent back and forth and will use a three-way handshake for all communication.
您可以研究 Facebook 和 Twitter 等流行 API 使用的不同身份验证技术，这些 API 使用 OAuth 方法验证。
其他 API（例如 Google 地图 (v2) 和 Bitly）允许您使用 URL 中的 API 密钥访问其 API。因此，每个用户都有一个可在请求中使用的 API 密钥，例如 http://api.domain.com/ get?key=supersecureapikey
这两种方法都非常出色，并且在整个网络中广泛使用，只有直接从 javascript 访问 API 才会暴露 API 密钥/密码。解决这个问题的一个选项（我使用的选项）是让 javascript 调用服务器上的一个文件，该文件在服务器端执行 API 调用，从而保证密钥/密码[更多]的安全。
You could look into different authentication techniques used by popular APIs like Facebook and Twitter which use the OAuth method for authentication.
Other APIs like Google Maps (v2) and Bitly let you access their API with an API key in the URL. So each user has an API key to use in the request like http://api.domain.com/get?key=supersecureapikey
Both methods are excellent and are widely used throughout the web, only accessing APIs directly from javascript will expose API keys/passwords. One option (the option I use) to get around this is to have the javascript call a file on your server which performs the API call on the server side, thus keeping keys/passwords [more] secure.