|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/jwt-authentication-using-mern-stack/
课程评论：没有评论
**课程名称：** 使用 MERN 堆栈进行 JWT 身份验证 **课程概述：** 本课程深入探讨 JSON Web Token (JWT)，这是一个开放标准 (RFC 7519)，用于在各方之间以 JSON 对象的形式安全地传输信息。JWT 的关键特性在于其紧凑性和自我包含性，使其易于通过 URL、POST 参数或 HTTP 标头传输，从而实现快速通信。 **JWT 的核心组成部分：** * **Header:** 包含关于令牌类型（例如 JWT）和所使用的签名算法（例如 HMAC SHA256、RSA SHA256）的元数据。 * **Payload:** 包含声明（claims），即关于用户和/或令牌本身的有关信息。最常见的声明是用户 ID、发布者、过期时间等。 * **Signature:** 用于验证令牌的完整性和真实性。它通过使用 Header 中指定的算法和密钥对 Header 和 Payload 进行签名而生成。 **JWT 的优势：** * **紧凑性：** 尺寸小，便于传输。 * **自我包含性：** 载荷包含所有必要的用户信息，减少了数据库查询次数。 * **验证信任：** 通过数字签名确保信息的真实性和完整性。 **在身份验证中的应用：** 用户成功登录后，服务器会生成一个 JWT 并返回给客户端。客户端将此令牌存储起来，并在后续访问受保护资源时，将其包含在 HTTP 请求的 `Authorization` 标头中（通常使用 `Bearer` 方案）。服务器接收到令牌后，会验证其签名和信息，从而确定用户的身份和权限。 **安全注意事项：** * **令牌安全：** JWT 作为凭证，必须妥善保管，避免泄露。 * **存储建议：** 不建议在浏览器存储中存储敏感的会话数据，因为其安全性较低。 * **过期管理：** 令牌不应超过必需的时间长度而保留。 本课程旨在教授学员如何利用 JWT 在 MERN (MongoDB, Express.js, React, Node.js) 技术栈中实现安全高效的用户身份验证。
What is JSON Web Token?JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.JSON Web Token (JWT, pronounced /dʒɒt/, same as the word "jot"[1]) is a proposed Internet standard for creating data with optional signature and/or optional encryption whose payload holds JSON that asserts some number of claims. The tokens are signed either using a private secret or a public/private key.JWTs consist of three parts separated by dots (.), which are:HeaderPayloadSignatureLet's explain some concepts of this definition further.Compact: Because of its size, it can be sent through an URL, POST parameter, or inside an HTTP header. Additionally, due to its size its transmission is fast.Self-contained: The payload contains all the required information about the user, to avoid querying the database more than once.In authentication, when the user successfully logs in using their credentials, a JSON Web Token will be returned. Since tokens are credentials, great care must be taken to prevent security issues. In general, you should not keep tokens longer than required.You also should not store sensitive session data in browser storage due to lack of security.Whenever the user wants to access a protected route, it should send the JWT, typically in the Authorization header using the Bearer schema. Therefore the content of the header should look like the following.
