Lightweight Single Sign-on system best practices (iv) -- Chapter 4 common web-Sso implementation

With the rapid development of the Internet, web applications almost dominated the vast majority of software application systems, so WEB-SSO is the most popular SSO application. WEB-SSO has its own characteristics and advantages, to achieve relatively simple and easy to use.

As we all know, the Web protocol (HTTP) is a stateless protocol. A Web application consists of multiple web pages, each of which is defined by a unique URL. The user enters the URL of the page in the address bar of the browser, and the browser sends a request to the web server. For example, the browser sends two requests to the Web server and applies for two pages. The two page requests use two separate HTTP connections. The so-called stateless protocol is shown here. the browser and the web server will close the connection channel after the first request is completed, and re-establish the connection at the second request. The Web server does not distinguish the client from which the request comes from. All requests are connected separately. This method is much different from the traditional (Client/Server) C/S structure. In such an application, the client and server will establish a dedicated connection channel for a long time. It is precisely because of stateless features that each connection resource can be quickly reused by other clients that a Web server can serve thousands of clients at the same time.

However, our common applications are stateful. You do not need to mention SSO between different applications. In the same application, you also need to save your login identity information. For example, the user logged on when accessing page 1, but as mentioned earlier, each client request is a separate connection. When the customer accesses page 2 again, how can I tell the web server that the customer has logged on just now? There is an agreement between the browser and the server: The Cookie technology is used to maintain the application status. Cookie is a string that can be set by the Web server and can be saved in the browser. As shown in, when the browser accesses page 1, the web server sets a cookie and returns the cookie together with page 1 to the browser. After the browser receives the cookie, it will save it, when it accesses page 2, it will also bring this cookie. When the Web server receives a request, it can also read the cookie value, you can determine and restore the Information Status of some users based on the content of the cookie value.

Web-Sso can use cookies to save user login information, and combine the cookies in the browser with the ticket mentioned above to complete the SSO function.

To complete a simple SSO function, we need to work with the following two parts:

L Uniform Identity Authentication Service.

L modify the web application so that each application performs identity verification through this unified authentication service.