会话过期后仅使用 Http cookie 用户身份验证
堆栈：
- 前端= Vue
- 后端= Strapi（基于节点的cms）+ postgresql
我已经构建了一个仅使用http cookie的身份验证机制。用户登录，然后将一个仅 http 的 cookie 发送给用户。用户将其保存在浏览器中，但无法使用 javascript 访问它。因此，cookie 或多或少受到了 xss 的保护。
问题是；当用户离开网站并在 2 天后返回时，客户端的身份验证布尔值仍然表示用户已通过身份验证。但实际上 cookie 已经过期了。我想检查 cookie 是否有经验，但这是不可能的，因为它只是 http，客户端代码无法访问。
你们如何解决这个问题？有哪些最佳实践？
干杯
我考虑过在分发饼干的那一刻设置一个计时器或日期戳。但这意味着我会不断检查。
Stack:
- frontend = Vue
- backend = Strapi (node based cms) + postgresql
I have build a authentication mechanism that uses http only cookies. The user logs in, then a http only cookie is send to the user. The users saves this in the browser but can not access it using javascript. Therefore the cookie is more or less protected from xss.
The problem with this is; when a user leaves the website and comes back after let's say 2 days, the authentication boolean on the client side still says that the user is authenticated. But in reality the cookie is already expired. I would like to check the cookie for experiation, but that is not possible as it is http only and not accessible by client code.
How do you guys go over this and what are some best practices?
cheerss
I have thought about setting a timer or datestamp on the moment of handing out the cookie. But that would mean I would be constantly checking.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我有类似的设置。正如您提到的，JavaScript 不可能访问 http cookie，并且在 cookie 过期期间运行计时器也不是很理想。
我所做的就是不执行任何操作，直到用户执行需要身份验证的操作（例如，单击对后端执行 HTTP GET 的按钮）。用户执行此操作后，如果 cookie 已过期，我会从后端获取 302、401 或 403 HTTP 状态代码之一，当发生这种情况时，Javascript 获取请求中的 .then 块会重定向到身份验证服务器因此用户再次登录以获取新的 cookie，然后继续执行原来的操作。
并不是说这是最好的方法，但它对我来说效果很好。希望这有帮助。
I have a similar setup. As you mentioned it's not possible for JavaScript to access the http cookie, and having a timer run for the period of cookie expiry is not very desirable.
What I do is to do nothing until the user user performs an action that requires authentication (e.g. click a button that does a HTTP GET to the backend). Once the user does that and if the cookie had already expired, I get one of the 302, 401 or 403 HTTP status codes from the backend, and when this happens the .then block in the Javascript fetch request does a redirect to the authentication server so the user logs in again to get a new cookie, and then continues with the original action.
Not claiming this is the best method but it's working well for me. Hope this helps.