离线网络应用程序需要本地存储的安全凭证
我有一个可以使用 HTML5 离线缓存离线运行的 Web 应用程序。我在客户端上存储用户密码的 sha256 哈希值，这允许我让用户在离线时本地登录，但我不需要在本地存储实际密码。
我想介绍一些功能，如果应用程序上线，那么应用程序将自动登录到服务器，而无需用户重新输入密码。这意味着我要么需要以某种方式在客户端上存储实际密码，要么需要将散列密码传递到服务器以允许服务器对用户进行身份验证。这两种方法似乎都有缺点：
我不相信我可以将密码安全地存储在客户端上（javascript 变量就可以，但是随着页面刷新，var 就会超出范围。Cookie 或会话存储或本地存储都可以） 我已经在本地
存储了密码的 sha256 哈希值，但是如果我在服务器上打开一个方法来允许该哈希值对用户进行身份验证，那么我也将打开安全性，
任何人都可以有任何好主意 。在这个上？谢谢
（服务器是 ASP.NET MVC C#）
I have a web app that can run offline using HTML5 offline cache. I am storing an sha256 hash of the user's password on the client, which allows me to let the user login locally when offline, but I don't need to store the actual password locally.
I would like to introduce some functionality whereby if the app becomes online then the app will automatically logon to the server without the user having to re-key their password. This means I either need to store the actual password on the client somehow, or I need to pass the hashed password to the server to allow the server to authenticate the user. Both these methods seem to have drawbacks:
I don't beleive I can store the password securely on the client (a javascript variable would do, but with page refreshes then the var goes out of scope. Cookies or session storage or local storage can all be too easily viewed.
I am already storing the sha256 hash of the password locally, but if I open up a method on the server to allow this hash to authenticate the user then I am also opening up the security rather.
Anyone got any bright ideas on this one? Thanks.
(Server is ASP.NET MVC C#)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以将散列密码存储在 IndexedDB 或 WebSQL 数据库中，因为这两个数据库都很难读取 - 尽管 Chrome 开发人员工具确实允许您访问它们（如果您知道如何操作） - 尽管 Internet Explorer 不支持这两个数据库。但如果您的应用程序离线运行，那并不重要；）
You could store the hashed password in an IndexedDB or WebSQL database, as both of those are quite difficult to read - though the Chrome Developer Tools do allow you to get access to them if you know how - though neither of those are supported in Internet Explorer. But if your app is running offline, that doesn't matter ;)