简体繁体 English

Redis 过期复制到从站

[英]Redis expiration replication to slaves

原文 2020-05-28 18:38:40 3 1 redis/ redis-cluster

I am interested in using Redis to store a customer's session on the server side for authorization.我有兴趣使用 Redis 在服务器端存储客户的 session 以进行授权。 Basically, when a customer logs in a hash will be stored in a Redis cluster and the key returned to the client.基本上，当客户登录时，hash 将存储在 Redis 集群中，并将密钥返回给客户。 On each request, the client will pass the key as a header and the service will check that the hash still exists in Redis, if it doesn't then an error message will be returned.在每个请求中，客户端将密钥作为 header 传递，服务将检查 hash 是否仍然存在于 Redis 中，如果不存在，则将返回一条错误消息。 This key will expire after X minutes resulting in any requests using that key to fail.该密钥将在 X 分钟后过期，导致使用该密钥的任何请求失败。 However, I have been reading online that some people experienced issues because of the way the expiration is replicated to slaves.但是，我一直在网上阅读到一些人因为过期复制到奴隶的方式而遇到问题。 Slaves only expire a key when they receive a del command from the master so if a "get" is made on a slave before this command, the value at that key will be returned.从站仅在收到来自主站的 del 命令时才使密钥过期，因此如果在此命令之前对从站进行“获取”，则将返回该密钥的值。

https://github.com/antirez/redis/issues/187 https://github.com/antirez/redis/issues/187

Does this issue still exist?这个问题还存在吗？ It seems like a big issue to me and would create a bit of a security hole.这对我来说似乎是个大问题，会造成一些安全漏洞。 Maybe not a big deal for stale data but when using for authorization it is a big deal对于陈旧数据来说可能没什么大不了的，但是当用于授权时这很重要

1 个解决方案

A) no, not really — since 2014, a GET of an expired key will return "not found" on a slave even if the slave hasn't yet received a DEL from the replication stream. The outstanding issue has to do with EXISTS being inconsistent with GET, which only matters if you rely on the output of the EXISTS command. A）不，不是真的——自 2014 年以来，即使从属尚未从复制 stream 收到 DEL，过期密钥的 GET 也会在从属上返回“未找到”。突出的问题与 EXISTS 相关与 GET 不一致，仅当您依赖 EXISTS 命令的 output 时才有意义。

B) Completely independent of this issue, the possibility of replication lag always exists. b) 完全独立于此问题，复制滞后的可能性始终存在。 The security of your app shouldn't depend on the premise that replicas are always up-to-date.您的应用程序的安全性不应依赖于副本始终是最新的前提。