Twitter.com 缓存清除后如何注销用户？
今天下午我注意到一些非常有趣的事情 - 当我清除浏览器缓存和 cookie 时，Twitter 立即将我注销。
我假设他们每秒左右通过 Javascript 轮询一次身份验证 cookie，并在 cookie 丢失时注销用户。关于这是如何完成的还有其他猜测吗？
由于这是我第一次遇到这种行为，我想知道它有多常见、实现它的最佳方法以及在实现它时应该考虑的任何安全问题（如果有）。
I noticed something very interesting this afternoon - when I clear my browser cache and cookies, Twitter immediately signs me out.
I assume they are polling for an authentication cookie every second or so via Javascript, and signing out users if the cookie is missing. Any other guesses as to how this is done?
Since this is my first encounter with this behavior, I'm wondering how common it is, the best way to accomplish it, and any security concerns one should have when implementing it (if any).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
任何网站知道您已登录的唯一方法是通过您的浏览器在后续请求中发送的 cookie。如果 cookie 不再存在，那么根据定义，您将不再登录到他们的网站。
我不太确定您对“实现它的最佳方法”的要求是什么。实现它的最佳方法到底是什么？
如果您询问通过 cookie 保持浏览器登录状态的最佳方法是什么，那么它可以归结为在 cookie 中存储会话或用户 ID。会话 ID 更受青睐，因为每个“会话”都有不同的值。
关于使用 cookie 来保证安全性的普遍程度：它们几乎无处不在。唯一不使用 cookie 来存储您的会话 ID 的情况是会话 ID 出现在查询字符串中。
现在谈谈安全问题。通常这些 cookie 的寿命非常有限，对于您的浏览器会话而言，因此当您关闭浏览器时，cookie 就会过期。如果站点启用了 ssl，则 cookie 的内容在通过网络传输时会被加密。如果没有，那么您就无法防御中间人攻击或数据包捕获攻击。 （查找火羊）。
The only way any site knows that you are logged in is via a cookie that your browser sends on subsequent requests. If the cookie no longer exists then by definition you are no longer logged into their site.
I'm not exactly sure what you are asking regarding the "best way to accomplish it".. Best way to accomplish what exactly?
If your asking what the best way is to accomplish keeping a browser logged in via a cookie, then it boils down to storing a session or user id in the cookie. Session ID is much preferred as it is a different value for each "session".
Regarding how common using cookies for security is: they are pretty much everywhere. The only time cookies aren't used for storing your session id is if the session id appears in the query string.
Now onto security concerns. Usually those cookies have a very limited lifespan, that to your browser session so that when you close the browser the cookie expires. If the site is ssl enabled then the contents of the cookie are encrypted as they pass over the wire. If not, well, you don't have any defense against man in the middle or packet capture attacks. (look up firesheep).
当您打开 Twitter 时，一些 JavaScript 代码会定期轮询服务器以获取新推文。发生的情况是您在非常接近轮询时间时清除了缓存，因此看起来您的缓存清除将您注销了，而实际上这只是一个预定的轮询。由于您清除了 cookie，当 twitter 去检查更多推文时，该请求没有您的登录 cookie，服务器将您注销。
我刚刚对此进行了测试，当我清除 cookie 时，在 Twitter 尝试获取更多推文之前，不会发生任何事情。
While you have twitter open, some javascript code polls the server periodically for new tweets. What happened was you cleared your cache very close to polling time, so it appeared that your cache clearing logged you out, when in reality it was just a scheduled poll. Since you cleared your cookies, when twitter went to check for more tweets, that request didn't have your login cookie and the server logged you out.
I just tested this, and when I clear my cookies, nothing happens for a bit until twitter tries to get more tweets.