生成安全代码的算法
我需要知道是否有某种已知的算法来生成安全代码。场景是这样的：
我有一个 Web 应用程序，其中用户有一个密码和一个电子邮件，需要在应用程序中进行识别和验证。 如果用户忘记了密码，我需要启用通过以下方式恢复密码的功能：
这应该
- 与一个窗口一起使用，用户在其中输入他的电子邮件，然后单击 名为“忘记密码”的按钮（或类似的内容）
- 此按钮应向用户的电子邮件发送安全代码
- 然后应用程序将用户重定向到新页面，用户必须在其中输入 收件箱中收到安全代码
- 如果用户输入的安全代码有效，那么他将被重定向到可以输入新密码的页面。
我正在寻找的是某种已知的方法来生成安全代码（步骤 2）并验证此安全代码（步骤 4）
提前致谢
I need to know if there is some kind of known algorithm to generate security codes. This is the scenario:
I have a web application, where the users has a password and an email to be identified and authenticated into the application.
In case the user forgots his password, I was required to enable the funcionality of recovering it in the following way:
This should wor
- k with a window, where the user enter his email, and click on a
button called "forgot password" (or something similar) - This button should send a security code to the users email
- Then the application redirects the user to a new page, where the user must enter the
security code received in his inbox - If the security code entered by the user is valid, then he is redirected to a page where he can introduce a new password.
What I'm looking for, is for some kind of known ways to generate the security code (step 2) and to validate this security code (step 4)
Thanks in advance
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
这里不需要加密。
There's no cryptography required here.
您可以使用消息身份验证代码来实现此目的。
You can use Message authentication code for this purpose.
正如前面的答案所述，您可以生成一个随机数和一个 32 位字符串密钥，存储在数据库中并将其传递到页面。要求用户输入数字，但 32 位应作为隐藏值放置在页面中。用户输入号码并提交后，这两个值都将到达后端，您可以验证这一点。如果匹配则允许或生成一个新的并再次呈现页面。这可以避免猜测以及暴力破解。
As told in the previous answer you can generate a random number and also a 32 bit string key, store in the database and pass it to the page. Ask the user to enter the number, but the 32 bit should be placed as a hidden value in the page. Once the user enters the number and submits both the values will come to the backend and you can verify that. If matches then allow or generate a new one and render the page again. This avoids guessing as well as brute forcing.