简体繁体 English

在实际项目中使用angular 2+和.Net CORE实现登录功能的一个好概念是什么？

[英]What is a good concept to implement login feature with angular 2+ and .Net CORE in real project?

原文 2018-11-15 03:49:35 0 1 angular/ asp.net-core/ login/ angular5

I am developing a login feature for an angular 5 web app. 我正在为angular 5 Web应用程序开发登录功能。 In the backend (.net core 2.0 ) I sent a token after user input correct username and password but in the client (angular 5) I wonder what the concept should I apply? 在后端（.net core 2.0）中，我在用户输入正确的用户名和密码后发送了令牌，但是在客户端（角度5）中，我想知道应该应用什么概念？ what plugins should I use? 我应该使用哪些插件？ should I store the token in localStorage ? 我应该将令牌存储在localStorage中吗？ does anyone have any idea? 有人有什么主意吗？ many thanks! 非常感谢！

1 个解决方案

You should firstly know the Pros/Cons of storing token in Web Storage (localStorage or sessionStorage) or in Cookie . 首先，您应该了解将令牌存储在Web Storage（localStorage或sessionStorage）或Cookie中的利弊。 Consider the security : 考虑安全性：

Web Storage (localStorage/sessionStorage) is accessible through JavaScript on the same domain. Web存储（localStorage / sessionStorage）可通过同一域上的JavaScript访问。 This means that any JavaScript running on your site will have access to web storage, and because of this can be vulnerable to cross-site scripting (XSS) attacks . 这意味着您站点上运行的所有JavaScript都可以访问Web存储，因此，它很容易受到跨站点脚本（XSS）攻击的攻击。

Cookies, when used with the HttpOnly cookie flag, are not accessible through JavaScript, and are immune to XSS. 与HttpOnly cookie标志一起使用时，cookie无法通过JavaScript访问，并且不受XSS的影响。 You can also set the Secure cookie flag to guarantee the cookie is only sent over HTTPS. 您还可以设置安全cookie标志，以确保仅通过HTTPS发送cookie。 However cookies are vulnerable to cross-site request forgery (CSRF) attacks . 但是，cookie容易受到跨站点请求伪造（CSRF）攻击。

You can refer to this thread which provides detail discussion about that . 您可以参考该线程，它提供了有关该线程的详细讨论。