Analyze single sign-on (flowchart and data security)

Source: Internet
Author: User

Last year, the company has done a single sign-on module, two sites, colleagues are based on cookies and session to achieve, in that module and no separate user authentication center, each child station has its own login system, in determining whether the user is logged on, The first is to determine whether the user is logged in or not by determining if the cookie exists. If the cookie value exists, the session is written and the login ticket is saved.

The general cookie-based program, to some extent the biggest problem is security, because it is stored as a file in the client. So generally very important information, such as user login information, user's bank card information will not be stored using cookies. Although cookies can be encrypted, But the individual always feel uneasy. For this I have been looking for a security level of the single point of entry program.

Not long ago, I saw this article: Single sign-on (SSO) component design and implementation of one, found that it is based on the session, it was particularly strange, because we know that the session is not across the application, and then carefully analyzed before we know the principle:

According to the idea of the program, I changed the implementation of the flowchart, personal good understanding:

If the Yumbo master saw this picture, also hope that the evaluation under the original thought? I am not particularly experienced in this area, can only understand this, hope everyone advice.

In addition to changing the single sign-on flowchart, I would like to discuss the differences and benefits based on cookies and two ways to implement the session:

In the solution above, federated site to achieve a single sign-on, it is necessary to interact with the certification center, this will be in the Web to pass the user login information, generally include the user name and user login password. This is our biggest concern, because the very important information about passwords is passed on the web.

Dangerous, the main is that there are illegal users to intercept the transmission of information to tamper with user information.

The solution above the original blogger to achieve very good, here I quote the original bar:

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.