Transmit passwords securely over normal HTTP. 1. Theoretically, in common HTTP, passwords in the form are transmitted to the server in plaintext mode for processing. This undoubtedly gives the bad guys a chance! Here we will talk about how to transmit Password 1. Theory
Generally, the passwords in the form are transmitted to the server in plain text for processing. This undoubtedly gives the bad guys a chance! Let's talk about how to transmit a password to ensure security!
It is better to transmit the encrypted form than the password itself. MD5 is a good choice. First, it is almost impossible for different resources to generate the same MD5 Digest. Second, the MD5 encoding method is irreversible. With these features, we can make the MD5 digest public over the Internet, without worrying about the password being known by the bad guys. Then, encrypt the password on the server side in the same way, and then compare the two strings.
However, we cannot directly transmit the md5 password over the Internet for login, because although the bad guys do not know our password, but you will surely know that this special string can authorize them to access our website!
This is the problem that the public and private keys need to be solved. the server first provides a random string, and the client adds the random string and password to the encryption!
Each time you log on to the server, the server will generate different random strings, so that your password is not changed, but the MD5 digest encrypted by the above method is completely different. In this way, even if the bad guys get these MD5 summaries, they cannot analyze your password!
In this method, the random string provided by the server is called "public key", which has a short life and can be used by anyone. your password is called "private key" and has a long life, and will never be known.
2. Implementation
The client-side Javascript does not provide a ready-made md5 algorithm, but we can use the "md5 javascript" search on google to obtain many examples of md5 implementation in Javascript.
In PHP, I don't need to talk about it. I can simply use the md5 () function! We can use session to store random strings (PHP is strong ~~)
3. Note:
In JS, the Chinese are UTF-8 format, so if your password is Chinese, and stored in the server password encoding method is GB2312, then the two encrypted strings are completely different!
Bytes. Theoretically, in common HTTP, passwords in the form are transmitted to the server in plaintext mode for processing. This undoubtedly gives the bad guys a chance! Here we will talk about how to transmit the password...
