Knockout.js 应用程序中的用户身份验证
（我在 Twitter 上被告知我在这里太含糊了，所以我会尝试进行编辑）
我刚刚开始将 Knockout.js 用于具有 PHP 后端（一个输出 JSON 结果的 API）的应用程序。该应用程序的某些部分将要求用户经过身份验证才能使用它们（这是一个用于投票选出谁“赢得”梦幻棒球联盟中特定交易的应用程序）
我想知道人们如何使用服务器端 API 和框架来处理身份验证，例如昏死。我可以轻松编写接受凭据、验证凭据并返回响应的 PHP 代码，我只是不知道如何使用 Knockout 维护用户已“经过身份验证”的状态。
再加上在多个页面上维护“经过身份验证的状态”的问题，我想知道这如何可能。在 PHP 中，您可以将这些内容存储在会话中，甚至可以使用 cookie。
我有丰富的 PHP 经验，所以我不担心这个小项目的 API 部分。我是 Knockout.js 的初学者（介于 Javascript 的初学者和中级之间），所以任何有关我如何实现这一目标的提示将不胜感激。
(I was told on Twitter I am being too vague here so I will try and edit)
I'm just starting to use Knockout.js for an application with a PHP back-end (an API that spits out JSON results). Parts of the application will requires users to be authenticated to use them (it's an app for voting on who "won" a particular transaction in a fantasy baseball league)
I am wondering how people are handling doing authentication using server-side APIs and frameworks like Knockout. I can easily write PHP code that accepts credentials validates them, and returns a response I just don't know how to maintain that state that the user is 'authenticated' using Knockout.
Add to that the problem of maintaining that 'authenticated state' across more than one page, and I'm wondering how it would even be possible. In PHP you could store that stuff inside the session or even using cookies.
I've got lots of experience with PHP so I'm not worried about the API part of this little side project. I'm a beginner with Knockout.js (and halfway between beginner and intermediate with Javascript) so any tips on how I can accomplish this would be greatly appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不存储经过身份验证的状态。使用响应代码，就像使用任何其他 API 一样。
最终后端流程（简化到极致）会是这样的：
在前端/客户端：
如果您突然遇到登录屏幕，这可能不是最好的用户体验设计。不过，这可以通过允许用户在任何时间点进行身份验证来规避，但要求除非绝对必要。 （为了最终的流畅性，您需要能够在身份验证成功后重放失败的请求。）
当然，对于后续请求，这需要您在服务器上运行会话，或者您的传输层可以透明地附加一个OAuth 令牌或类似于身份验证后的请求。
本质上，这与存储经过身份验证的状态相同，但更加透明，并且在任何时候都不会假设状态就是标志所说的那样。例如，假设您使用存储在 memcached 中的会话，该会话会出现段错误并重新启动。这意味着您的会话已经消失，任何经过身份验证的人都不再存在。如果您的前端仍然具有
authenticated = true并依赖它，那么事情就会崩溃。更新：
睡了一夜之后，我意识到你必须区分 401 和 403。由于可能存在不同级别的用户，因此你需要 403 来告诉前端/客户端即使该用户可能经过身份验证后，他仍然不被允许访问。
Don't store authenticated state. Work with response codes, as you would with any other API.
Ultimately the backend process (simplified to the extreme) would be something like this:
On the front end / client:
This might not be the best UX design out there, if you all of a sudden are faced with a login screen out of the blue. This can be circumvented though, by allowing the user to authenticate at any point in time, but don't require it until absolutely necessary. (And for ultimate smoothness, you need to be able to replay the request which failed once the authentication succeeds.)
Of course, for subsequent requests this requires either that you have a session running on the server or that your transport layer can transparently append an OAuth token or similar to requests after authentication.
Essentially this is the same as storing the authenticated state, but is more transparent and does at no point assume that the state is what the flag says. Say, for example, that you use sessions which you store in a memcached, which segfaults and restarts. This means your sessions are gone and anyone who was authenticated is not anymore. If your front end still has the
authenticated = trueand relies on it, stuff will break.UPDATE:
After sleeping on this overnight, I realize you must differentiate between 401 and 403. Since there may be users of different levels, you need 403 to tell the front end / client that even though this user may be authenticated he still isn't allowed access.
您可以使用 cookie 存储经过身份验证的状态，方法是在任何经过身份验证的请求（即登录）的响应标头中发送 cookie。浏览器将保留该信息并将其发送到后续请求的标头中。无需在您的应用程序中手动管理。
您需要设计 Knockout.js 模型来处理未经授权时来自 API 的失败响应，但即使没有身份验证，您仍然会这样做。
（如果您需要在应用程序中了解用户是否在不执行 API 请求的情况下登录，您可以检查 cookie（在 JS 中手动检查，或使用类似 jquery-cookie)
You can store the authenticated state using a cookie, by sending a cookie in the response header of any authenticated request (i.e. login). The browser will hold on to that and send it in the headers of subsequent requests. No need to manage that manually in your app.
You'd need to design your Knockout.js models to handle failure responses from the API when not authorized, but you would be doing that anyway even without authentication.
(If you need to know in your app whether the user is logged in without performing an API request, you can check the cookie (manually in JS, or with a library like jquery-cookie)
存储 cookie 是个好主意。让它变得简单是关键。
Storing the cookie is a great idea. Making it simple is the key.