JWT / HttpOnly

JWT

Json Web Token,代替cookie session,解决CSRF（Cross Site Request Forge）。包括header,payload，签名,存储在客户端Loal Storage中。

1
header = '{"alg":"HS256","typ":"JWT"}'
1
payload = '{"loggedInAs":"admin","iat":1422779638}'//iat表示令牌生成的时间
1
2
3
key = 'secretkey'  
unsignedToken = encodeBase64(header) + '.' + encodeBase64(payload)  
signature = HMAC-SHA256(key, unsignedToken) 
1
2
3
4
token = encodeBase64(header) + '.' + encodeBase64(payload) + '.' + encodeBase64(signature) 

# token看起来像这样: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsb2dnZWRJbkFzIjoiYWRtaW4iLCJpYXQiOjE0MjI3Nzk2Mzh9.gzSraSYS8EXBxLN_oWnFSRgCzcmJmMjLiuyu5CSpyHI

http header

1
Authorization: Bearer eyJhbGci*...<snip>...*yu5CSpyHI

HttpOnly

cookie头中一个属性，避免CSS（Cross Site Script).JS不能读取Cookie, 只能服务端读。e