Authentication and Authorization - GitHub Pages
[Pages:42]THE CHINESE UNIVERSITY OF HONG KONG
IERG4210 Web Programming and Security
Course Website: Live FB Feedback Group:
Authentication and Authorization
Lecture 7
Dr. Adonis Fung phfung@ie.cuhk.edu.hk
Information Engineering, CUHK Product Security Engineering, Yahoo!
CUHK - IERG4210 Web Programming and Security (2015 Spring)
Copyright. All Rights Reserved. 1
Agenda
? Session Management
? HTTP: from Stateless to Stateful ? Session Maintenance: Cookies, HTML5 localStorage ? Extension to Server-side Session Storage
? Authentication & Authorization
? Authentication v.s. Authorization ? Authentication using Cookies ? Authentication using HTTP Auth ? Authentication Attacks
CUHK - IERG4210 Web Programming and Security (2015 Spring)
Adonis P.H. FUNG 2
HTTP is Stateless
? HTTP is stateless
? Each request is independent to each other ? Sufficient for serving static content (.html, .css, .jpg, etc...)
... [request response], [request response], [request response] ...
? Problem: the server cannot tell which requests come from same user?
? For personalized services,
? Example: any signed-in user experience ? The key is to associate requests originated from the same user,
i.e. maintaining user session
CUHK - IERG4210 Web Programming and Security (2015 Spring)
Adonis P.H. FUNG 3
Making HTTP "Stateful" using Cookies
? HTTP Cookies Mechanism
? Given it is the first visit,
? Browser makes a request to without any Cookies ? Server gives a Cookie value (w/Set-Cookie response header) to the browser
? For subsequent visits,
? Browser automatically replays Cookies in subsequent requests (w/Cookie request header) to until the expiry date
? Session Maintenance using Cookies
? Cookie Values can store user preferences (theme=yellow) ? Setting a random, unique, and unpredictable token (a.k.a. session id):
? The server can then isolate a user-specific session, i.e., a brunch of requests having the same unique session id
? Usage: Personalization, Authentication and Session Storage
CUHK - IERG4210 Web Programming and Security (2015 Spring)
Adonis P.H. FUNG 4
Cookies Communications
? Cookies := a small ( ................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- express js in action by evan hahn
- table of contents
- authentication and authorization github pages
- cs247l wed april 9 2014 sunny
- complete secrets tips for professionals
- express web framework for node
- expressjs tutorialspoint
- node js express http request
- c s e 1 5 4 w e b p r o g r a mmi n g n o d e j s e
- what is
Related searches
- beckett authentication submission form
- authorization and consent
- authentication vs authentification
- authentication and authorization similarities
- sba loan authorization and agreement
- and subtract fractions pages 695 698
- 14 1 geography and early cultures pages 382 385
- 14 1 geography and early cultures pages 386 391
- background check disclosure and authorization form
- beckett authentication services
- authorization and consent for release
- 52 227 1 authorization and consent