基于令牌的(安全/身份验证)

This means that in order for us to prove that we’ve access we first have to receive the token. In a real-life scenario, the token could be an access card to the building, it could be the key to the lock to your house. In order for you to retrieve a key card for your office or the key to your home, you first need to prove who you are and that you in fact do have access to that token. It could be something as simple as showing someone your ID or giving them a secret password. So imagine I need to get access to my office. I go down to the security office, I show them my ID, and they give me this token, which lets me into the building. Now I have unrestricted access to do whatever I want inside the building, as long as I have my token with me.

基于令牌的安全性有什么好处?

回想一下不安全API，在这种情况下，我们必须为我们想做的所有事情提供密码。

Imagine that every time we enter a door in our office, we have to give everyone sitting next to the door our password. Now that would be pretty bad because that means that anyone inside our office could take our password and impersonate us, and that’s pretty bad. Instead, what we do is that we retrieve the token, of course together with the password, but we retrieve that from one person. And then we can use this token wherever we want inside the building. Of course, if we lose the token, we have the same problem as if someone else knew our password, but that leads us to things like how do we make sure that if we lose the token, we can revoke the access, and maybe the token shouldn’t live for longer than 24 hours, so the next day that we come to the office, we need to show our ID again. But still, there’s just one person that we show the ID to, and that’s the security guard sitting where we retrieve the tokens.

When you register for a new website, often you are sent an email to activate your account. That email typically contains a link to click on. Part of that link, contains a token, the server knows about this token and can associate it with your account. The token would usually have an expiry date associated with it, so you may only have an hour to click on the link and activate your account. None of this would be possible with cookies or session variables, since its unknown what device or browser the customer is using to check emails.

我认为这里已经解释得很好了——只是引用了这篇长文的关键句子:

a背后的一般概念 基于令牌的认证系统是 简单。允许用户输入他们的 用户名和密码，以便 获得一个令牌，允许他们这样做 获取一个特定的资源-没有 使用用户名和密码。 一旦获得了他们的令牌， 用户可以提供令牌 提供对特定资源的访问 在一段时间内，对着遥控器 网站。

换句话说:为身份验证添加一个间接级别——用户不必为每个受保护的资源使用用户名和密码进行身份验证，而是以这种方式进行一次身份验证(在有限持续时间的会话内)，获得一个有时间限制的令牌作为回报，并在会话期间使用该令牌进行进一步的身份验证。

好处有很多——例如，用户一旦获得令牌，就可以将令牌传递给其他一些自动化系统，他们愿意在有限的时间和有限的资源集内信任这个系统，但不愿意信任他们的用户名和密码(即，他们被允许访问的每一个资源，永远或至少直到他们更改密码)。

如果还有什么不清楚的地方，请编辑你的问题，澄清你不是100%清楚的东西，我相信我们可以进一步帮助你。

问题老了，技术先进了，现在的状态是这样的:

JSON Web Token (JWT)是一个基于JSON的开放标准(RFC 7519)，用于在Web应用程序环境中在各方之间传递声明。令牌的设计是紧凑的，url安全的和可用的，特别是在web浏览器单点登录(SSO)上下文中。

https://en.wikipedia.org/wiki/JSON_Web_Token

从Auth0.com

Token-Based Authentication, relies on a signed token that is sent to the server on each request. What are the benefits of using a token-based approach? Cross-domain / CORS: cookies + CORS don't play well across different domains. A token-based approach allows you to make AJAX calls to any server, on any domain because you use an HTTP header to transmit the user information. Stateless (a.k.a. Server side scalability): there is no need to keep a session store, the token is a self-contained entity that conveys all the user information. The rest of the state lives in cookies or local storage on the client side. CDN: you can serve all the assets of your app from a CDN (e.g. javascript, HTML, images, etc.), and your server side is just the API. Decoupling: you are not tied to any particular authentication scheme. The token might be generated anywhere, hence your API can be called from anywhere with a single way of authenticating those calls. Mobile ready: when you start working on a native platform (iOS, Android, Windows 8, etc.) cookies are not ideal when consuming a token-based approach simplifies this a lot. CSRF: since you are not relying on cookies, you don't need to protect against cross site requests (e.g. it would not be possible to sib your site, generate a POST request and re-use the existing authentication cookie because there will be none). Performance: we are not presenting any hard perf benchmarks here, but a network roundtrip (e.g. finding a session on database) is likely to take more time than calculating an HMACSHA256 to validate a token and parsing its contents.

令牌是一段只有Server X可能创建的数据，它包含足够的数据来识别特定的用户。

您可以提供您的登录信息并向服务器X请求一个令牌;然后您可以呈现您的令牌，并要求服务器X执行一些特定于用户的操作。

令牌是使用来自密码学领域的各种技术的各种组合以及来自更广泛的安全研究领域的输入来创建的。如果你决定创建自己的代币系统，你最好非常聪明。