I m having a PHP script connect to and communicate with a Node.js server. The Node.js should only respond to requests from the PHP script so I need to make sure the Node server has some sort of authentication method.
现在,为了确定它实际上连接的公用钥匙基础结构的文字,我想只是使用一些廉价的认证,如发出事先共享的秘密,同时要求公用钥匙基础结构的文字。 诺德服务器仅将其与自己的秘密进行比较,如果与它相匹配,则可以假定其为连接的文字,而不是其他人(假定SSL已采用某种方法防止再起攻击)。
整个过程将由高频和高频通信系统完成,后者的附加奖金能够确认诺德服务器的身份。
Is this secure enough or should I do some proper SSL-based client authentication? After all, it s over HTTPS so the pre-shared secret shouldn t be easily sniffed out right?