Security purpose

Question

发送到服务器之前如何加密客户端登录？

Answer 1

You should use HTTPS.

Building security by yourself is hard , and you are very likely to get it wrong.
You should stick with the systems that the experts use.

On the server, remember to hash and salt the passwords, preferably using bcrypt.

Answer 2

There's one very simple solution. SSL . Ensure that all your login activities are served via https:// URLs.

The way that you do this, at least the "setting the server up" part vary depending on what web server you're using. You'd be better off asking a question of that nature on http://www.serverfault.com/

Answer 3

You can only use https - any client side encryption would be viewable on the client and therefore useless. There is SO question on this: password encryption at client side

Answer 4

You should really use HTTPS, but if you can't use HTTPS then the alternative is to create a hash.

1. Server generates a random 'salt' for the session
2. JavaScript on client-side creates a cryptographically secure hash of the user's password and the salt.
3. Hash is sent to the server, you can then retrieve the password from the database, create a hash using the salt for the session and the password from the DB and check if it is the same as the one sent from the client. - If it is then the password is a match.

An example of using JavaScript to protect passwords: http://pajhome.org.uk/crypt/md5/auth.html