谷歌 OpenID openid.return_to
如果我理解正确的话，如果用户批准身份验证，Google 会将用户带到 openid.return_to 中指定的位置。这是否意味着 openid.return_to 可能是会员区域的 URL？ Google 是否会创建 cookie 或其他内容来表明用户已通过身份验证？如果不是，我如何判断到达会员区的用户是否确实是通过 OpenID 登录的正版 Google 用户？
If I understand correctly, if the user approves the authentication, Google takes the user to the location specified in openid.return_to. Does that mean openid.return_to could be the URL to the members' area? Does Google create a cookie or something to indicate that the user has passed authentication? If not, how do I tell if a user arriving at the members' area is indeed a genuine Google user logged in via OpenID?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
返回该网址后，您应该验证它确实来自 Google。然后，如果验证成功，您可以假设用户已登录。否则，用户要么取消了身份验证，发送了虚假断言，要么只是身份验证过程出现了问题。
至于它是会员区的 url - 它可以是任何 url，但它已被访问并不意味着用户已登录。同样，您必须先验证它。
这是一个非常复杂的过程，并且取决于身份验证中的先前步骤，因此除非您想要 阅读规范，最好使用openid库来做那。
After returning to the url, you are supposed to verify that it does indeed come from Google. Then, if the verification is successful, you can assume that the user's logged in. Otherwise, the user has either canceled the authentication, sent a fake assertion, or simply something went wrong with the authentication process.
As for it being an url to the members' area - it can be any url, but the fact that it has been accessed doesn't mean that an user is logged in. Again, you have to verify it first.
It is a pretty complicated process, and depends on previous steps in authentication, so unless you want to read the specification, it would be best to use an openid library to do that.