English 中文(简体)
Cheap客户身份识别与SSL客户正确认证
原标题:Cheap client identification vs proper SSL client authentication

I m having a PHP script connect to and communicate with a Node.js server. The Node.js should only respond to requests from the PHP script so I need to make sure the Node server has some sort of authentication method.

现在,为了确定它实际上连接的公用钥匙基础结构的文字,我想只是使用一些廉价的认证,如发出事先共享的秘密,同时要求公用钥匙基础结构的文字。 诺德服务器仅将其与自己的秘密进行比较,如果与它相匹配,则可以假定其为连接的文字,而不是其他人(假定SSL已采用某种方法防止再起攻击)。

整个过程将由高频和高频通信系统完成,后者的附加奖金能够确认诺德服务器的身份。

Is this secure enough or should I do some proper SSL-based client authentication? After all, it s over HTTPS so the pre-shared secret shouldn t be easily sniffed out right?

最佳回答

HTTPS is not replayable (because the ServerHello message includes a random number used to produce the shared key for the connection), and since you are talking over a secure channel your pre-shared secret cannot be sniffed either. As a quick and not-so-dirty solution your scheme sounds fine to me.

问题回答

HTTPS的连接(总是,如果与适当的电离层相配,如果客户对服务器证书进行适当核实),将保护通信,并将防止对吉大港山区的请求进行再分析(因为吉大港山区实际申请获得的标记是显而易见的,而另一个客户则无法重新发挥准确的内容,因为它有不同的SSL课程。)

您的服务器和你的硬拷贝之间有事先共享的秘密,因此可以打上。

你可以使用客户验证认证,但这将使认证更加复杂,而没有这方面的必要好处。 您将不得不自行制作标签,使服务器相信。 更为重要的是,您可能不得不为重新谈判(如果可能的话)配置你的Node.js服务器,否则,所有与HTTPS服务器连接的客户都会为客户认证服务,而这对于大多数不需要这种服务用户来说可能是不方便的。





相关问题
Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

please can anyone check this while loop and if condition

<?php $con=mysql_connect("localhost","mts","mts"); if(!con) { die( unable to connect . mysql_error()); } mysql_select_db("mts",$con); /* date_default_timezone_set ("Asia/Calcutta"); $date = ...

定值美元

如何确认来自正确来源的数字。

Generating a drop down list of timezones with PHP

Most sites need some way to show the dates on the site in the users preferred timezone. Below are two lists that I found and then one method using the built in PHP DateTime class in PHP 5. I need ...

Text as watermarking in PHP

I want to create text as a watermark for an image. the water mark should have the following properties front: Impact color: white opacity: 31% Font style: regular, bold Bevel and Emboss size: 30 ...

How does php cast boolean variables?

How does php cast boolean variables? I was trying to save a boolean value to an array: $result["Users"]["is_login"] = true; but when I use debug the is_login value is blank. and when I do ...

热门标签