table of Contents
Three certification
Certified Components
Certification involves three types: legitimate users of illegal users, visitors Log in
RBAC model:
RBAC: Role-based access control, that is, Who of What (Which) How were operating, which who-- is the owner or principal permission (eg: User, Role), what-- resources or objects (Resource, Class)
There are two traditional RBAC: three tables authority and permission five tables, three tables privileges => Privileges five table
In Django auth component uses a permissions six tables (UP increase in the traditional relational table based on RBAC)
The User table, Group table, table established between Permission-many relationship, resulting in six interrelated tables, so you can time during the packet will be distributed to multiple user permissions for users, not one by one for distribution.
In django, use the auth module to create a user table, the user management table must be completed in the first database migration
is_active: whether it is active users, 0 represents the change to be deleted
is_staff: whether it is the background user can operate the admin
Permissions components
Determining whether the user's permission to access, divided user permission levels
Have permission
No permission
Frequency components
Restrict access to the frequency of access to each time period
jwt certification rules
jwt：json web token
jwt Certification advantages:
1. The database does not need to store token, it reduces the server IO operations (no IO operations)
2. Client deposit token, the server stores only be issued with a check algorithm, high efficiency
3. The issuance of the check algorithm can be directly unity across multiple servers, so the next jwt certification rules, server cluster is very easy to do
jwt certification breakthrough:
1.token must have a plurality of parts, some of the solution can counter, also not part inverse solution 8 / a, are used in three-JWT
In 2.token must include an expiration time, to ensure the safety and timeliness token
jwt principle:
1.jwt the head. Load. Signature three parts
2. Each portion of the data dictionary is a json, header and payload base64-reversible encryption algorithm, the signature using the irreversible encryption HS256
content:
1. Head (General Information): reversible non-reversible encryption algorithm employed, company name, team information, developer information
2. Load (core information): the user's home key, user account, client device information, the expiration time (to be added)
3. Signature (security information): the results of the first encryption, the encryption result of the load, the server security code (salt)
Issued algorithm:
1. Head-coded content (which may be empty {}), converted into the data field encrypted string into base64 string json
2. The content of the load, a user account, the client device information is provided by the client, the user is the primary key to determine the client account and password verification provided by the User table, expiration date combination generated according to the current time and the expiration time of the configuration
3. The signature of the content, encryption result of the first header, payload encryption result as a member, and then take the security code from the server (can not let any client know), you can additionally contain partial load (user information, device information)
4. The three strings connection three-generated token
Check algorithm:
1. get request from the client submitted token, with segmentation into three segments (if not three sections, illegal)
2. Head (first paragraph) can not decrypt,
3. load (second stage) must be decrypted, to decrypt into json base64 characters, converted to json dictionary data,
User primary key query and user account User table to determine if the user exists,
Comparative information device device information submitted with this request, before and after to determine whether the same device, the user decides whether to make safety tips, (eg: SMS mailbox prompt remote login) (same security can also IP, landing sites, etc.)
Expires contrast with the current practice, whether the token within a valid time
4. Signature (third stage) encrypted checksum collision,
The header, payload, and database security encryption code string dictionary json formed, it is converted into a string json
Irreversible encrypted form using an encryption string HS256
The new encrypted string with the third paragraph of the signature collision contrast, has been to ensure that the token is legitimate
The front of the algorithms obtained by loading User verification, the token is represented by the login user (usually the Django item stored in the user log in request.user)
Refresh algorithm:
1. To load issued token, the extra time to add two information: the first time issued token, the most effective time to refresh later
2. Each request carries a token, not only to go check algorithm, authentication token is legitimate, but also requested additional refresh token interface, complete refresh token, the validation rules and validation algorithm almost, but after the expiration time you want to move ( does not exceed the effective time, a new token to the client, if exceeded, refresh failed)
3. So not only configure the server expiration time, but also to configure the maximum refresh time