Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
PHP 也有 Day #48:我是誰?我在哪?
Search
Star Rocket
October 01, 2019
Technology
0
53
PHP 也有 Day #48:我是誰?我在哪?
PHP 也有 Day #48:我是誰?我在哪?
Star Rocket
October 01, 2019
Tweet
Share
More Decks by Star Rocket
See All by Star Rocket
PHP 也有 Day #51:高效能框架的曙光 - 以 Laravel 經驗開發 Hyperf 應用
starrocket
1
280
PHP 也有 Day #50:處理前人的遺產—聊 legacy code
starrocket
0
65
PHP 也有 Day #49:邊緣人救星!用 Laravel 打造私人定製的聊天機器人
starrocket
0
370
PHP 也有 Day #48:我是誰?我在哪?
starrocket
0
50
API-整合測試
starrocket
0
99
How we talk about Engineering Culture at Phase
starrocket
0
35
PHP 也有 Day #47:打造好維護的 PHP 程式碼專案
starrocket
0
280
全端起手就用 Laravel+Vue.js 現場實作給你看
starrocket
0
180
PHP 也有 Day #45: VS Code 實戰料理 PHP 套件網站佐 Azure Pipelines
starrocket
0
87
Other Decks in Technology
See All in Technology
キャッシュレス決済のプロダクトから決済基盤への進化
b1a9id
0
200
Zero Data Loss Autonomous Recovery Service サービス概要
oracle4engineer
PRO
2
7.3k
Introduction to Sansan for Engineers / エンジニア向け会社紹介
sansan33
PRO
5
38k
Vibe Codingの裏で、 考える力をどう取り戻すか
csekine
0
260
Kafka vs. Pulsar: Performance Evaluation by Petabyte-Scale Streaming Platform Providers
lycorptech_jp
PRO
1
300
バクラクのモノレポにおける AI Coding のための環境整備と {Roo,Claude} Code活用事例 / AI Coding in Bakuraku's Monorepo: Environment Setup & Case Studies with {Roo, Claude} Code
upamune
6
1.4k
ソフトウェアテストのAI活用_ver1.20
fumisuke
0
200
Oracle Cloud Infrastructureデータベース・クラウド:各バージョンのサポート期間
oracle4engineer
PRO
48
32k
AIエージェント実践集中コース LT
okaru
1
180
SwiftUI Transaction を徹底活用!ZOZOTOWN UI開発での活用事例
tsuzuki817
1
130
DevOpsDays Taipei 2025 - Opening Remarks
cheng_wei_chen
0
120
AI Engineering Summit Pre Event LT #10
okaru
2
220
Featured
See All Featured
Balancing Empowerment & Direction
lara
1
100
The Pragmatic Product Professional
lauravandoore
35
6.7k
Let's Do A Bunch of Simple Stuff to Make Websites Faster
chriscoyier
507
140k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
52
2.8k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
30
2.1k
Visualization
eitanlees
146
16k
KATA
mclloyd
29
14k
Statistics for Hackers
jakevdp
799
220k
Mobile First: as difficult as doing things right
swwweet
223
9.6k
Building Better People: How to give real-time feedback that sticks.
wjessup
368
19k
XXLCSS - How to scale CSS and keep your sanity
sugarenia
248
1.3M
The Cult of Friendly URLs
andyhume
78
6.4k
Transcript
我是誰︖我在哪︖ 聊聊 Web 的身分驗證
ABOUT MILES CURRENT Senior Developer @ 104 Corp. Volunteer @
DevOps Taiwan TAG PHP, Docker, DevOps
[email protected]
MilesChou
None
今天將會聊些什麼 Terminology Scenario Native App Security Topic
Terminology Authentication Entity Identifier
Server User
Server User Entity
Server User Entity Identifier
Server User Entity Identifier Miles Miles
Server User Entity Identifier Authentication Miles Miles
基本的安全問題 請求真的是該使⽤者本身的意願所發出的請求嗎︖ 有沒有可能被竄改︖有沒有機會造假︖ 回應真的是伺服器的回應嗎︖ 有沒有可能被竄改︖有沒有機會造假︖
Scenario 從前從前,有個網站提供了很多服務
安安你好,第⼀一次來來嗎? 第⼀一次來來的都是絕緣⼈人哦! 為了了讓你不再絕緣, 你先跟我講好,要怎麼驗證你是誰!
註冊的⽬的 使⽤者提供憑證資訊,如帳號、密碼、etc 伺服器提供 metadata
註冊的⽅法 線上註冊 私訊註冊 線下註冊
User Login 身為⼀個使⽤者,我希望能使⽤網站提供的服務
安安你好,第⼆二次來來嗎? 站著!⼝口令?誰? 我知道你是麥爾斯了了,可是我⾦金金⿂魚腦! 24 分鐘內記得過來來刷新⼀一下!
User Login Challenge State Management Mechanism
實作 Laravel Auth Zend Authentication
Server-side Authentication 身為⼀個伺服器,我希望能呼叫網站提供的 API
How about Authorization?
Server-side Authentication Trusted Server VPN、鎖 IP、發 token、etc. OAuth 2.0 Facebook、Google、GitHub、AWS、etc.
Terminology - OAuth 2.0 Authorization Resource Owner Resource Server Client
Authorization Server
Authorization Server Resource Owner Resource Server Client Authorization Request
Authorization Server Resource Owner Resource Server Client Authorization Grant
Authorization Server Resource Owner Resource Server Client Authorization Grant
Authorization Server Resource Owner Resource Server Client Access Token
Authorization Server Resource Owner Resource Server Client Access Token
Authorization Server Resource Owner Resource Server Client Protected Resource
微信偷連結 Facebook︖ 到底花⽣省魔術︖請看 VCR!
微信偷連結 Facebook︖ Facebook 實作了 OAuth 2.0 微信 App 為 Client
授權範圍
Third-party Login 身為⼀個外部網站,我希望能透過貴站做身分驗證
安安你好,你是麥爾斯的跟班嗎? 有刷過麥爾斯的臉就可以進場了了哦! 但過⼀一回兒後, 我還會再跟麥爾斯確認,你還是不是他的跟班
Third-party Login OAuth 2.0 Facebook, Google, GitHub, etc. OpenID Connect
AppleID, Line, Google, Auth0, etc. SAML GitHub, Google, etc.
Server User Provider Authentication Check
OpenID Connect
OpenID Connect Based-on OAuth 2.0 Use JWT on ID token
Discovery Dynamic Client Registration
Authorization Server Client End User Login
Authorization Server Client End User Redirect to Authorization Server scope=openid
Authorization Server Client End User Authorization Request
GET / POST
Authorization Server Client End User Challenge
Authorization Server Client End User User Credentials
Authorization Server Client End User Authorization Request
Authorization Server Client End User Authorization Grant
Authorization Server Client End User Redirect to Client with Code
Authorization Server Client End User Use Code to get Access
Token ID Token
ID token
簽章 圖⽚來源:https://en.wikipedia.org/wiki/File:Private_key_signing.svg
簽章演算法 HS256 - HMVC using SHA-256 Line RS256 - RSASSA-PKCS1-v1_5
using SHA-256 AppleID, Google ES256 - ECDSA using P-256 and SHA-256 AppleID
Discovery AppleID Line Google
⽤用講的不就很會? 做⼀一個來來看看啊!
Demo
Native App
先講結論 不要⽤嵌入式 User Agent,即麻煩又危險 可使⽤ PKCE 來解決這個問題
Chrome on Mobile 圖⽚來源:https://www.ory.sh/oauth2-for-mobile-app-spa-browser/
App on Mobile 圖⽚來源:https://www.ory.sh/oauth2-for-mobile-app-spa-browser/
Security Topic
基本 TLS CSRF XSS CSP Same-origin Policy
HTML 登入 無標準協定 網路釣⿂
Covert Redirect Redirect url 驗證
清除登入狀態 Token Revoke 的時機 OpenID Session Management Front-Channel Logout Back-Channel
Logout
Extra - Password 千萬不要存明碼 MD5 與 SHA1 已被認為是不安全的演算法 建議使⽤ SHA256
Extra - Cookie 問題核⼼在於過度依賴 Cookie 作為身分驗證的⼿段 CSRF Session Hijacking Session
Fixation Weak Confidentiality Weak Integrity
Q & A