在前端加密用户密码有什么意义？
我正在使用一个 API，该 API 要求在发送到服务器之前使用服务器的公钥对用户密码进行加密。如果整个请求，包括用户名/密码等。通过HTTPS发送，密码加密不是多余的吗？
I'm working with an API that requires the user's password to be encrypted with the server's public key before sending to the server. If the whole request, including username/password/etc. is being sent through HTTPS, isn't the password encryption redundant?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
根据服务器体系结构，这种加密可能会有所帮助。例如，可以在网络周围终止（解密）TLS（HTTPS）连接，以简化负载平衡或扫描流中的恶意数据包。分别加密密码即使从边缘服务器中保护密码，因此能够妥协的攻击者仍然无法访问密码。
就我个人而言，我在发送之前，我会伸展（即PBDKF2）密码。这样可以确保服务器根本看不到原始密码。但是，即使在该配置中，当TLS流早期解密时，哈希的额外加密也可能有用。
Depending on the server architecture, this kind of encryption can be helpful. For example, the TLS (HTTPS) connection may be terminated (decrypted) at the perimeter of the network in order to simplify load balancing or to scan the stream for malicious packets. Separately encrypting the password protects the password even from the edge servers, so an attacker who is able to compromise one of those still cannot gain access to the password.
Personally I stretch (i.e. PBDKF2) passwords before sending them. This ensures that the raw password is never seen by the server at all. But even in that configuration, an extra layer of encryption for the hash could be useful when the TLS stream is decrypted early.