离线网络应用程序中的用户身份验证
我正在构建一个需要离线工作的网络应用程序。该系统旨在捕获销售交易。大部分“离线”部分相当简单——我只需要在本地存储数据并在返回网络时同步它。到目前为止，一切都很好。
问题在于身份验证。该应用程序将在具有单个操作系统用户帐户的共享计算机上运行。如果我处于离线状态，如何验证用户身份？
用户本身没有任何我需要隔离的私人数据（即，我不必在客户端上保护他们免受彼此的影响）。我需要能够验证他们的密码，这样即使连接断开，我也可以让不同的用户全天登录。
我正在考虑的一种方法是将密码哈希值缓存在客户端的 IndexedDB 中。仅允许一组有限的用户从特定的共享计算机登录，因此我不需要在本地缓存整个密码数据库。假设我有一个良好的密码策略（复杂性和过期要求），并且哈希本身是安全的（bcrypt），这是一个多么可怕的想法？
我还有其他选择吗？
I'm building a web app that needs to work offline. The system is built to capture sales transactions. The bulk of the "offline" part is fairly straightforward -- I just need to store data locally and sync it when I'm back on the network. So far, so good.
The problem is with authentication. The app will run on a shared machine with a single OS user account. If I'm offline, how do I authenticate the user?
Users themselves do not have any private data that I will need to segregate (i.e., I don't have to protect them from each other on the client). I need to be able to validate their password so I can let different users login throughout the day even if the connection is down.
One approach I'm thinking of involves caching the password hashes on the client-side in an IndexedDB. Only a limited set of users will be allowed to log in from a specific shared machine, so I won't need to cache my whole password database locally. Assuming that I have a good password policy (complexity and expiry requirements) in place and the hashes themselves are secure (bcrypt), just how horrible of an idea is this?
Do I have any other options?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
当计算机无法连接到域控制器时（例如，您将工作笔记本电脑带到飞机上并且需要在没有连接的情况下登录您的笔记本电脑），这就是 Windows（和其他系统）的有效工作方式。您的计算机已记录了您的用户名|密码对的缓存，即使处于离线状态，您也可以通过这些凭据进入。
我认为一般来说，存储用户名|密码哈希值是非常安全的，假设你对它们进行了合理的哈希处理（例如，使用盐、使用 IV 等）。您需要考虑的一个问题是哈希文件“逃逸”。如果这是敏感数据，您需要非常小心 - 这甚至可能是不可接受的，但如果它不是超级敏感数据，那么您可能没问题：通过良好的散列，我认为您应该合理（但肯定不是）完全）安全。
This is effectively how Windows (and other systems) work when the machine is not able to reach the domain controller (e.g., you take your work laptop onto the airplane and need to log into your laptop w/o connectivity). Your machine has written down a cache of your username|password pair and will let you in via those credentials even if it's offline.
I think generally speaking storing the username|password hashes is pretty safe, assuming you're hashing them reasonably (e.g., using a salt, using an IV, etc). One exposure you'll want to think through is having the hash file "escape." If this is sensitive data you'll want to be exceedingly careful -- and this may not even be acceptable, but if it's not super sensitive data then you're probably OK: with good hashing I think you should be reasonably (but certainly not completely) safe.
也许这有点无关，但我在我的 Nodejs 项目中使用了这种方法。
当用户通过用户名和密码进行身份验证时，他/她将被分配一个仅用于此特定会话的唯一 API 密钥。
每个用户只能拥有一个 API 密钥。
此 API 密钥会添加到向服务器发出的任何请求中，以对用户进行身份验证。
当用户注销时，API 密钥将被删除。此外，API 密钥还可以在服务器上清除，这使得用户可以在服务器上再次进行身份验证。
如果您感兴趣，我可以提供使用这种方法的 Nodejs 开源程序的链接。
Maybe this is little unrelated, but I use this approach in my nodejs project.
When a user is authenticated by username and password, he/she is assigned a unique API key used only for this particular session.
Each user can have only one API key.
This API key is added to any request done to server, to authenticate the user.
When the user logs out, the API key is deleted. Also the API key can be purged on the server, that makes the user authenticate on the server one more time.
I can provide links to nodejs open source programs that use this approach if you interested.