{"id":39873,"date":"2025-05-26T10:33:23","date_gmt":"2025-05-26T02:33:23","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/39873.html"},"modified":"2025-05-26T10:33:23","modified_gmt":"2025-05-26T02:33:23","slug":"%e5%85%b3%e4%ba%8e-web%e5%ae%89%e5%85%a8%ef%bc%9a1-web-%e5%ae%89%e5%85%a8%e5%9f%ba%e7%a1%80%e7%9f%a5%e8%af%86","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/39873.html","title":{"rendered":"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6"},"content":{"rendered":"<h3>\u4e00\u3001HTTP\/HTTPS \u534f\u8bae\u8be6\u89e3<\/h3>\n<h4>1.\u00a0HTTP\u534f\u8bae\u57fa\u7840<\/h4>\n<p>\u4ec0\u4e48\u662f HTTP&#xff1f;<\/p>\n<p>HTTP&#xff08;HyperText Transfer Protocol&#xff09;\u662f\u4e92\u8054\u7f51\u4e2d\u6d4f\u89c8\u5668\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u4f20\u8f93\u6570\u636e\u7684\u534f\u8bae&#xff0c;\u57fa\u4e8e\u8bf7\u6c42-\u54cd\u5e94\u6a21\u5f0f\u3002\u5b83\u662f\u4e00\u4e2a\u65e0\u72b6\u6001\u534f\u8bae&#xff0c;\u610f\u601d\u662f\u6bcf\u6b21\u8bf7\u6c42\u90fd\u662f\u72ec\u7acb\u7684&#xff0c;\u670d\u52a1\u5668\u4e0d\u4f1a\u8bb0\u4f4f\u4e4b\u524d\u7684\u8bf7\u6c42\u72b6\u6001\u3002<\/p>\n<p>HTTP \u5de5\u4f5c\u6a21\u5f0f<\/p>\n<ul>\n<li>\n<p>\u5ba2\u6237\u7aef&#xff08;\u6d4f\u89c8\u5668\u3001\u722c\u866b\u7b49&#xff09;\u53d1\u8d77\u8bf7\u6c42<\/p>\n<\/li>\n<li>\n<p>\u670d\u52a1\u5668\u63a5\u6536\u8bf7\u6c42&#xff0c;\u5904\u7406\u540e\u8fd4\u56de\u54cd\u5e94<\/p>\n<\/li>\n<li>\n<p>\u53cc\u65b9\u901a\u8fc7TCP\u8fde\u63a5&#xff08;\u901a\u5e38\u662f80\u7aef\u53e3&#xff09;\u8fdb\u884c\u901a\u4fe1<\/p>\n<\/li>\n<\/ul>\n<h4>2.\u00a0HTTP \u8bf7\u6c42\u7ed3\u6784<\/h4>\n<p>HTTP \u8bf7\u6c42\u7531\u56db\u90e8\u5206\u7ec4\u6210&#xff1a;<\/p>\n<p>\u8bf7\u6c42\u884c&#xff08;Request Line&#xff09;<br \/>\n\u8bf7\u6c42\u5934&#xff08;Request Headers&#xff09;<br \/>\n\u7a7a\u884c<br \/>\n\u8bf7\u6c42\u4f53&#xff08;Request Body&#xff0c;\u53ef\u9009&#xff09;<\/p>\n<p>1&#xff09;\u8bf7\u6c42\u884c<\/p>\n<p>\u683c\u5f0f&#xff1a;<\/p>\n<p>METHOD URL HTTP\/VERSION<\/p>\n<ul>\n<li>\n<p>METHOD&#xff1a;\u8bf7\u6c42\u65b9\u6cd5&#xff0c;\u5982 GET\u3001POST\u3001PUT\u3001DELETE \u7b49<\/p>\n<\/li>\n<li>\n<p>URL&#xff1a;\u8bf7\u6c42\u7684\u8d44\u6e90\u8def\u5f84\u548c\u53c2\u6570<\/p>\n<\/li>\n<li>\n<p>HTTP\/VERSION&#xff1a;HTTP\u7248\u672c&#xff0c;\u5982 HTTP\/1.1<\/p>\n<\/li>\n<\/ul>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>GET \/index.html HTTP\/1.1<\/p>\n<p>2&#xff09;\u8bf7\u6c42\u5934<\/p>\n<p>\u952e\u503c\u5bf9\u683c\u5f0f&#xff0c;\u544a\u77e5\u670d\u52a1\u5668\u5ba2\u6237\u7aef\u4fe1\u606f&#xff1a;<\/p>\n<ul>\n<li>\n<p>Host: \u5fc5\u987b&#xff0c;\u76ee\u6807\u670d\u52a1\u5668\u57df\u540d\u548c\u7aef\u53e3<\/p>\n<\/li>\n<li>\n<p>User-Agent: \u5ba2\u6237\u7aef\u8f6f\u4ef6\u4fe1\u606f<\/p>\n<\/li>\n<li>\n<p>Accept: \u53ef\u63a5\u53d7\u7684\u6570\u636e\u683c\u5f0f<\/p>\n<\/li>\n<li>\n<p>Cookie: \u6d4f\u89c8\u5668\u5b58\u50a8\u7684Cookie\u4fe1\u606f<\/p>\n<\/li>\n<li>\n<p>Content-Type: \u8bf7\u6c42\u4f53\u7c7b\u578b&#xff08;POST\/PUT&#xff09;<\/p>\n<\/li>\n<li>\n<p>Content-Length: \u8bf7\u6c42\u4f53\u5927\u5c0f&#xff08;\u5b57\u8282&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>Host: www.example.com<br \/>\nUser-Agent: Mozilla\/5.0<br \/>\nAccept: text\/html<br \/>\nCookie: sessionid&#061;abc123<\/p>\n<p>3&#xff09;\u7a7a\u884c<\/p>\n<p>\u8bf7\u6c42\u5934\u548c\u8bf7\u6c42\u4f53\u4e4b\u95f4\u5fc5\u987b\u6709\u4e00\u4e2a\u7a7a\u884c\u3002<\/p>\n<p>4&#xff09;\u8bf7\u6c42\u4f53<\/p>\n<ul>\n<li>\n<p>\u53ea\u6709\u90e8\u5206\u8bf7\u6c42\u65b9\u6cd5&#xff08;\u5982POST\u3001PUT&#xff09;\u6709\u8bf7\u6c42\u4f53<\/p>\n<\/li>\n<li>\n<p>\u901a\u5e38\u643a\u5e26\u63d0\u4ea4\u7684\u6570\u636e&#xff0c;\u5982\u8868\u5355\u3001JSON\u3001\u6587\u4ef6\u7b49<\/p>\n<\/li>\n<\/ul>\n<h4>3.\u00a0HTTP \u54cd\u5e94\u7ed3\u6784<\/h4>\n<p>HTTP \u54cd\u5e94\u7531\u56db\u90e8\u5206\u7ec4\u6210&#xff1a;<\/p>\n<p>\u72b6\u6001\u884c&#xff08;Status Line&#xff09;<br \/>\n\u54cd\u5e94\u5934&#xff08;Response Headers&#xff09;<br \/>\n\u7a7a\u884c<br \/>\n\u54cd\u5e94\u4f53&#xff08;Response Body&#xff09;<\/p>\n<p>1&#xff09;\u72b6\u6001\u884c<\/p>\n<p>\u683c\u5f0f&#xff1a;<\/p>\n<p>HTTP\/VERSION STATUS_CODE REASON_PHRASE<\/p>\n<ul>\n<li>\n<p>STATUS_CODE&#xff1a;\u4e09\u4f4d\u6570\u5b57&#xff0c;\u8868\u793a\u8bf7\u6c42\u72b6\u6001<\/p>\n<\/li>\n<li>\n<p>REASON_PHRASE&#xff1a;\u7b80\u77ed\u63cf\u8ff0\u72b6\u6001\u7801<\/p>\n<\/li>\n<\/ul>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>HTTP\/1.1 200 OK<\/p>\n<p>2&#xff09;\u54cd\u5e94\u5934<\/p>\n<p>\u63cf\u8ff0\u54cd\u5e94\u7684\u5143\u6570\u636e&#xff1a;<\/p>\n<ul>\n<li>\n<p>Content-Type: \u54cd\u5e94\u4f53\u683c\u5f0f\u548c\u7f16\u7801<\/p>\n<\/li>\n<li>\n<p>Content-Length: \u54cd\u5e94\u4f53\u5927\u5c0f<\/p>\n<\/li>\n<li>\n<p>Set-Cookie: \u8bbe\u7f6eCookie<\/p>\n<\/li>\n<li>\n<p>Cache-Control: \u7f13\u5b58\u7b56\u7565<\/p>\n<\/li>\n<li>\n<p>Server: \u670d\u52a1\u5668\u4fe1\u606f<\/p>\n<\/li>\n<\/ul>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>Content-Type: text\/html; charset&#061;UTF-8<br \/>\nContent-Length: 1024<br \/>\nSet-Cookie: sessionid&#061;abc123; HttpOnly<br \/>\nCache-Control: no-cache<\/p>\n<p>3&#xff09;\u7a7a\u884c<\/p>\n<p>\u54cd\u5e94\u5934\u548c\u54cd\u5e94\u4f53\u4e4b\u95f4\u5fc5\u987b\u6709\u7a7a\u884c\u3002<\/p>\n<p>4&#xff09;\u54cd\u5e94\u4f53<\/p>\n<p>\u670d\u52a1\u5668\u8fd4\u56de\u7684\u5b9e\u9645\u6570\u636e&#xff0c;\u6bd4\u5982HTML\u9875\u9762\u3001JSON\u3001\u56fe\u7247\u7b49\u3002<\/p>\n<h4>4.\u00a0HTTP \u72b6\u6001\u7801\u8be6\u89e3<\/h4>\n<p>\u72b6\u6001\u7801\u53cd\u6620\u670d\u52a1\u5668\u5bf9\u8bf7\u6c42\u7684\u5904\u7406\u7ed3\u679c&#xff0c;\u6309\u9996\u4f4d\u6570\u5b57\u5206\u7c7b&#xff1a;<\/p>\n<table>\n<tr>\u7c7b\u522b\u4ee3\u7801\u8303\u56f4\u63cf\u8ff0\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>1xx<\/td>\n<td>100-199<\/td>\n<td>\u4fe1\u606f\u6027\u72b6\u6001\u7801<\/td>\n<td>\u8bf7\u6c42\u5df2\u63a5\u6536&#xff0c;\u7ee7\u7eed\u5904\u7406<\/td>\n<\/tr>\n<tr>\n<td>2xx<\/td>\n<td>200-299<\/td>\n<td>\u6210\u529f<\/td>\n<td>\u8bf7\u6c42\u6210\u529f\u5b8c\u6210<\/td>\n<\/tr>\n<tr>\n<td>3xx<\/td>\n<td>300-399<\/td>\n<td>\u91cd\u5b9a\u5411<\/td>\n<td>\u9700\u8981\u5ba2\u6237\u7aef\u8fdb\u4e00\u6b65\u64cd\u4f5c&#xff0c;\u5982\u8df3\u8f6c<\/td>\n<\/tr>\n<tr>\n<td>4xx<\/td>\n<td>400-499<\/td>\n<td>\u5ba2\u6237\u7aef\u9519\u8bef<\/td>\n<td>\u8bf7\u6c42\u6709\u9519\u8bef&#xff0c;\u5982\u53c2\u6570\u4e0d\u5408\u6cd5\u3001\u672a\u6388\u6743\u7b49<\/td>\n<\/tr>\n<tr>\n<td>5xx<\/td>\n<td>500-599<\/td>\n<td>\u670d\u52a1\u5668\u9519\u8bef<\/td>\n<td>\u670d\u52a1\u5668\u5904\u7406\u8bf7\u6c42\u65f6\u53d1\u751f\u9519\u8bef<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u5e38\u89c1\u72b6\u6001\u7801\u793a\u4f8b<\/p>\n<table>\n<tr>\u72b6\u6001\u7801\u542b\u4e49<\/tr>\n<tbody>\n<tr>\n<td>200<\/td>\n<td>OK \u2014 \u8bf7\u6c42\u6210\u529f<\/td>\n<\/tr>\n<tr>\n<td>201<\/td>\n<td>Created \u2014 \u8d44\u6e90\u6210\u529f\u521b\u5efa<\/td>\n<\/tr>\n<tr>\n<td>301<\/td>\n<td>Moved Permanently \u2014 \u6c38\u4e45\u91cd\u5b9a\u5411<\/td>\n<\/tr>\n<tr>\n<td>302<\/td>\n<td>Found \u2014 \u4e34\u65f6\u91cd\u5b9a\u5411<\/td>\n<\/tr>\n<tr>\n<td>304<\/td>\n<td>Not Modified \u2014 \u8d44\u6e90\u672a\u4fee\u6539&#xff0c;\u4f7f\u7528\u7f13\u5b58<\/td>\n<\/tr>\n<tr>\n<td>400<\/td>\n<td>Bad Request \u2014 \u8bf7\u6c42\u683c\u5f0f\u9519\u8bef<\/td>\n<\/tr>\n<tr>\n<td>401<\/td>\n<td>Unauthorized \u2014 \u672a\u8ba4\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>403<\/td>\n<td>Forbidden \u2014 \u7981\u6b62\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>404<\/td>\n<td>Not Found \u2014 \u8d44\u6e90\u672a\u627e\u5230<\/td>\n<\/tr>\n<tr>\n<td>500<\/td>\n<td>Internal Server Error \u2014 \u670d\u52a1\u5668\u9519\u8bef<\/td>\n<\/tr>\n<tr>\n<td>503<\/td>\n<td>Service Unavailable \u2014 \u670d\u52a1\u4e0d\u53ef\u7528<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>5.\u00a0HTTP\u5de5\u4f5c\u6d41\u7a0b<\/h4>\n<li>\n<p>\u5ba2\u6237\u7aef\u53d1\u8d77 TCP \u8fde\u63a5&#xff0c;\u901a\u5e38\u8fde\u63a5\u5230\u670d\u52a1\u5668\u7684 80 \u7aef\u53e3<\/p>\n<\/li>\n<li>\n<p>\u53d1\u9001 HTTP \u8bf7\u6c42<\/p>\n<\/li>\n<li>\n<p>\u670d\u52a1\u5668\u5904\u7406\u8bf7\u6c42\u5e76\u8fd4\u56de HTTP \u54cd\u5e94<\/p>\n<\/li>\n<li>\n<p>\u5ba2\u6237\u7aef\u89e3\u6790\u54cd\u5e94&#xff0c;\u6839\u636e\u54cd\u5e94\u72b6\u6001\u6267\u884c\u540e\u7eed\u64cd\u4f5c<\/p>\n<\/li>\n<li>\n<p>\u6839\u636e Connection \u5934\u662f\u5426\u4e3a keep-alive \u51b3\u5b9a\u662f\u5426\u5173\u95ed\u8fde\u63a5<\/p>\n<\/li>\n<h4>6.\u00a0HTTPS\u534f\u8bae\u8be6\u89e3<\/h4>\n<p>HTTPS \u662f\u4ec0\u4e48&#xff1f;<\/p>\n<p>HTTPS \u662f\u5728 HTTP \u4e4b\u4e0a\u589e\u52a0\u4e86 SSL\/TLS \u52a0\u5bc6\u5c42\u7684\u5b89\u5168\u534f\u8bae&#xff0c;\u4e3b\u8981\u89e3\u51b3 HTTP \u660e\u6587\u4f20\u8f93\u5bfc\u81f4\u7684\u4fe1\u606f\u6cc4\u9732\u548c\u7be1\u6539\u95ee\u9898\u3002<\/p>\n<p>HTTPS \u7aef\u53e3<\/p>\n<p>\u9ed8\u8ba4\u7aef\u53e3\u662f 443\u3002<\/p>\n<p>HTTPS \u5de5\u4f5c\u6d41\u7a0b&#xff08;\u7b80\u5316\u7248&#xff09;<\/p>\n<li>\n<p>\u5ba2\u6237\u7aef\u53d1\u8d77 HTTPS \u8fde\u63a5\u8bf7\u6c42<\/p>\n<\/li>\n<li>\n<p>\u670d\u52a1\u5668\u8fd4\u56de\u6570\u5b57\u8bc1\u4e66&#xff08;\u5305\u542b\u516c\u94a5&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u5ba2\u6237\u7aef\u9a8c\u8bc1\u8bc1\u4e66&#xff08;\u662f\u5426\u7531\u53ef\u4fe1CA\u7b7e\u53d1\u3001\u662f\u5426\u8fc7\u671f\u3001\u57df\u540d\u662f\u5426\u5339\u914d&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u5ba2\u6237\u7aef\u751f\u6210\u5bf9\u79f0\u5bc6\u94a5&#xff0c;\u7528\u670d\u52a1\u5668\u516c\u94a5\u52a0\u5bc6\u540e\u53d1\u7ed9\u670d\u52a1\u5668<\/p>\n<\/li>\n<li>\n<p>\u670d\u52a1\u5668\u7528\u79c1\u94a5\u89e3\u5bc6\u5f97\u5230\u5bf9\u79f0\u5bc6\u94a5<\/p>\n<\/li>\n<li>\n<p>\u53cc\u65b9\u4f7f\u7528\u5bf9\u79f0\u5bc6\u94a5\u52a0\u5bc6\u901a\u4fe1\u6570\u636e<\/p>\n<\/li>\n<p>HTTPS \u7279\u70b9<\/p>\n<ul>\n<li>\n<p>\u52a0\u5bc6\u901a\u4fe1&#xff1a;\u4fdd\u62a4\u6570\u636e\u4e0d\u88ab\u7a83\u542c<\/p>\n<\/li>\n<li>\n<p>\u8eab\u4efd\u8ba4\u8bc1&#xff1a;\u9632\u6b62\u4f2a\u9020\u670d\u52a1\u5668<\/p>\n<\/li>\n<li>\n<p>\u6570\u636e\u5b8c\u6574\u6027&#xff1a;\u9632\u6b62\u6570\u636e\u88ab\u7be1\u6539<\/p>\n<\/li>\n<li>\n<p>\u9632\u6b62\u4e2d\u95f4\u4eba\u653b\u51fb<\/p>\n<\/li>\n<\/ul>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u5185\u5bb9\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>HTTP \u8bf7\u6c42<\/td>\n<td>\u8bf7\u6c42\u884c &#043; \u8bf7\u6c42\u5934 &#043; \u7a7a\u884c &#043; \u8bf7\u6c42\u4f53&#xff08;\u53ef\u9009&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>HTTP \u54cd\u5e94<\/td>\n<td>\u72b6\u6001\u884c &#043; \u54cd\u5e94\u5934 &#043; \u7a7a\u884c &#043; \u54cd\u5e94\u4f53<\/td>\n<\/tr>\n<tr>\n<td>\u72b6\u6001\u7801<\/td>\n<td>1xx\u4fe1\u606f&#xff0c;2xx\u6210\u529f&#xff0c;3xx\u91cd\u5b9a\u5411&#xff0c;4xx\u5ba2\u6237\u7aef\u9519&#xff0c;5xx\u670d\u52a1\u5668\u9519<\/td>\n<\/tr>\n<tr>\n<td>HTTPS<\/td>\n<td>HTTP &#043; SSL\/TLS\u52a0\u5bc6<\/td>\n<\/tr>\n<tr>\n<td>HTTPS \u5de5\u4f5c\u6d41\u7a0b<\/td>\n<td>\u8bc1\u4e66\u4ea4\u6362\u3001\u5bc6\u94a5\u534f\u5546\u3001\u52a0\u5bc6\u901a\u4fe1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u4e8c\u3001Cookie \u8be6\u89e3<\/h3>\n<p>Cookie \u662f\u670d\u52a1\u5668\u901a\u8fc7 HTTP \u54cd\u5e94\u5934 Set-Cookie \u5411\u5ba2\u6237\u7aef&#xff08;\u6d4f\u89c8\u5668&#xff09;\u5199\u5165\u7684\u4e00\u6bb5\u5c0f\u578b\u6570\u636e&#xff0c;\u6d4f\u89c8\u5668\u4f1a\u5728\u4e0b\u4e00\u6b21\u8bf7\u6c42\u65f6\u81ea\u52a8\u5c06\u5b83\u9644\u5e26\u5728\u8bf7\u6c42\u5934 Cookie \u4e2d\u53d1\u9001\u7ed9\u670d\u52a1\u5668&#xff0c;\u7528\u4e8e\u72b6\u6001\u4fdd\u6301\u3002<\/p>\n<p>Cookie \u5177\u6709\u4ee5\u4e0b\u7279\u6027&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u6bcf\u4e2a Cookie \u5927\u5c0f\u4e0d\u8d85\u8fc7 4KB<\/p>\n<\/li>\n<li>\n<p>\u540c\u4e00\u57df\u540d\u4e0b\u6700\u591a\u5b58\u50a8 20 \u4e2a Cookie&#xff08;\u6d4f\u89c8\u5668\u4e0d\u540c\u7565\u6709\u5dee\u5f02&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u81ea\u52a8\u9644\u5e26\u5230\u76f8\u540c\u57df\u540d\u7684\u6bcf\u6b21\u8bf7\u6c42\u4e2d<\/p>\n<\/li>\n<\/ul>\n<h4>1.\u00a0Cookie \u7684\u57fa\u672c\u7ed3\u6784<\/h4>\n<p>Set-Cookie \u54cd\u5e94\u5934\u683c\u5f0f&#xff1a;<\/p>\n<p>Set-Cookie: name&#061;value; Path&#061;\/; Expires&#061;Wed, 01 Jan 2025 00:00:00 GMT; HttpOnly; Secure; SameSite&#061;Strict<\/p>\n<p>\u5e38\u89c1\u5c5e\u6027\u8be6\u89e3&#xff1a;<\/p>\n<table>\n<tr>\u5c5e\u6027\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>name&#061;value<\/td>\n<td>\u952e\u503c\u5bf9\u6570\u636e<\/td>\n<\/tr>\n<tr>\n<td>Expires<\/td>\n<td>\u8fc7\u671f\u65f6\u95f4&#xff08;\u7edd\u5bf9\u65f6\u95f4&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>Max-Age<\/td>\n<td>\u5b58\u6d3b\u65f6\u95f4&#xff08;\u79d2&#xff0c;\u4f18\u5148\u4e8e Expires&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>Path<\/td>\n<td>\u9650\u5236\u5728\u54ea\u4e9b\u8def\u5f84\u4e0b Cookie \u4f1a\u88ab\u53d1\u9001<\/td>\n<\/tr>\n<tr>\n<td>Domain<\/td>\n<td>\u53ef\u8de8\u5b50\u57df\u8bbf\u95ee\u7684\u8bbe\u7f6e&#xff0c;\u5982 .example.com<\/td>\n<\/tr>\n<tr>\n<td>Secure<\/td>\n<td>\u4ec5\u5728 HTTPS \u8fde\u63a5\u4e0b\u624d\u53d1\u9001<\/td>\n<\/tr>\n<tr>\n<td>HttpOnly<\/td>\n<td>JS \u4e0d\u80fd\u8bbf\u95ee&#xff0c;\u9632\u6b62 XSS \u76d7\u53d6<\/td>\n<\/tr>\n<tr>\n<td>SameSite<\/td>\n<td>\u63a7\u5236\u8de8\u7ad9\u8bf7\u6c42\u65f6\u662f\u5426\u53d1\u9001&#xff08;Strict \/ Lax \/ None&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2.\u00a0Cookie \u7684\u4f5c\u7528<\/h4>\n<p>\u72b6\u6001\u4fdd\u6301&#xff08;Session \u7ba1\u7406&#xff09;<\/p>\n<ul>\n<li>\n<p>\u767b\u5f55\u72b6\u6001&#xff1a;\u5982 sessionid&#061;abc123<\/p>\n<\/li>\n<li>\n<p>\u7528\u6237\u504f\u597d&#xff1a;\u5982 lang&#061;zh-CN<\/p>\n<\/li>\n<li>\n<p>\u8d2d\u7269\u8f66&#xff1a;\u8bb0\u5f55\u52a0\u5165\u5546\u54c1\u7684 ID<\/p>\n<\/li>\n<\/ul>\n<p>\u8ffd\u8e2a\u7528\u6237\u884c\u4e3a<\/p>\n<ul>\n<li>\n<p>\u7edf\u8ba1\u9875\u9762\u8bbf\u95ee\u3001\u70b9\u51fb\u884c\u4e3a<\/p>\n<\/li>\n<li>\n<p>\u7b2c\u4e09\u65b9\u5e7f\u544a Cookie&#xff08;\u5982 Google Analytics&#xff09;<\/p>\n<\/li>\n<\/ul>\n<h4>3.\u00a0Cookie \u751f\u547d\u5468\u671f<\/h4>\n<p>\u4f1a\u8bdd Cookie&#xff08;Session Cookie&#xff09;<\/p>\n<ul>\n<li>\n<p>\u4e0d\u8bbe\u7f6e Expires \u6216 Max-Age<\/p>\n<\/li>\n<li>\n<p>\u6d4f\u89c8\u5668\u5173\u95ed\u540e\u81ea\u52a8\u5931\u6548<\/p>\n<\/li>\n<\/ul>\n<p>\u6301\u4e45 Cookie&#xff08;Persistent Cookie&#xff09;<\/p>\n<ul>\n<li>\n<p>\u8bbe\u7f6e\u4e86 Expires \u6216 Max-Age<\/p>\n<\/li>\n<li>\n<p>\u5373\u4f7f\u5173\u95ed\u6d4f\u89c8\u5668&#xff0c;\u6307\u5b9a\u65f6\u95f4\u5185\u4f9d\u7136\u6709\u6548<\/p>\n<\/li>\n<\/ul>\n<h4>4.\u00a0Cookie \u7684\u5b89\u5168\u95ee\u9898<\/h4>\n<p>1&#xff09;XSS \u653b\u51fb&#xff08;\u8de8\u7ad9\u811a\u672c&#xff09;\u76d7\u53d6 Cookie<\/p>\n<p>\u653b\u51fb\u8005\u901a\u8fc7\u6ce8\u5165\u6076\u610f JS \u4ee3\u7801&#xff0c;\u8c03\u7528 document.cookie \u8bfb\u53d6\u7528\u6237 Cookie \u5e76\u53d1\u9001\u7ed9\u8fdc\u7a0b\u670d\u52a1\u5668\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u8bbe\u7f6e HttpOnly&#xff0c;\u9632\u6b62 JS \u8bbf\u95ee Cookie<\/p>\n<\/li>\n<li>\n<p>\u5bf9\u7528\u6237\u8f93\u5165\u8fdb\u884c\u4e25\u683c\u8fc7\u6ee4\u6216\u8f6c\u4e49<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;CSRF \u653b\u51fb&#xff08;\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020&#xff09;<\/p>\n<p>\u5229\u7528\u7528\u6237\u6d4f\u89c8\u5668\u5df2\u5b58\u7684 Cookie \u5411\u76ee\u6807\u7f51\u7ad9\u53d1\u8d77\u4f2a\u9020\u8bf7\u6c42&#xff0c;\u5982\u63d0\u4ea4\u8868\u5355\u3001\u8f6c\u8d26\u7b49\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u8bbe\u7f6e SameSite&#061;Strict \u6216 Lax<\/p>\n<\/li>\n<li>\n<p>\u4f7f\u7528 CSRF Token \u9a8c\u8bc1\u6765\u6e90\u5408\u6cd5\u6027<\/p>\n<\/li>\n<\/ul>\n<p>3&#xff09;Cookie \u52ab\u6301<\/p>\n<p>\u5982\u679c\u7528\u6237\u5728 HTTP \u4e0b\u4f20\u8f93 Cookie&#xff0c;\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u4e2d\u95f4\u4eba\u653b\u51fb&#xff08;MITM&#xff09;\u622a\u83b7 Cookie\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u8bbe\u7f6e Secure \u5c5e\u6027&#xff0c;\u53ea\u5141\u8bb8 HTTPS \u4f20\u8f93<\/p>\n<\/li>\n<li>\n<p>\u4f7f\u7528 HTTPS \u52a0\u5bc6\u6240\u6709\u901a\u4fe1<\/p>\n<\/li>\n<\/ul>\n<p>4&#xff09;Cookie \u56fa\u5b9a\u653b\u51fb&#xff08;Session Fixation&#xff09;<\/p>\n<p>\u653b\u51fb\u8005\u63d0\u524d\u8bbe\u7f6e\u7528\u6237 Cookie&#xff0c;\u8bf1\u5bfc\u7528\u6237\u4f7f\u7528\u8be5 Cookie \u767b\u5f55&#xff0c;\u4ece\u800c\u590d\u7528 Session\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u767b\u5f55\u6210\u529f\u540e\u91cd\u65b0\u751f\u6210 Cookie \/ Session ID<\/p>\n<\/li>\n<li>\n<p>\u62d2\u7edd\u6765\u6e90\u4e0d\u660e\u7684 Session Cookie<\/p>\n<\/li>\n<\/ul>\n<h4>5. Cookie \u793a\u4f8b&#xff08;\u8bf7\u6c42 &#043; \u54cd\u5e94&#xff09;<\/h4>\n<p>\u670d\u52a1\u7aef\u54cd\u5e94\u8bbe\u7f6e Cookie&#xff1a;<\/p>\n<p>HTTP\/1.1 200 OK<br \/>\nSet-Cookie: sessionid&#061;abc123; HttpOnly; Secure; SameSite&#061;Strict<\/p>\n<p>\u6d4f\u89c8\u5668\u4e0b\u4e00\u6b21\u8bf7\u6c42\u81ea\u52a8\u643a\u5e26 Cookie&#xff1a;<\/p>\n<p>GET \/user\/profile HTTP\/1.1<br \/>\nHost: example.com<br \/>\nCookie: sessionid&#061;abc123<\/p>\n<h4>6. Cookie \u4e0e\u6d4f\u89c8\u5668 JS \u64cd\u4f5c<\/h4>\n<p>\/\/ \u8bfb\u53d6<br \/>\nconsole.log(document.cookie); \/\/ name&#061;value; another&#061;123<\/p>\n<p>\/\/ \u8bbe\u7f6e<br \/>\ndocument.cookie &#061; &#034;token&#061;xyz456; path&#061;\/; max-age&#061;3600&#034;;<\/p>\n<p>\/\/ \u5220\u9664&#xff08;\u8bbe\u7f6e\u8fc7\u671f&#xff09;<br \/>\ndocument.cookie &#061; &#034;token&#061;; expires&#061;Thu, 01 Jan 1970 00:00:00 GMT&#034;;<\/p>\n<p>\u6ce8\u610f&#xff1a;\u5982\u679c\u8bbe\u7f6e\u4e86 HttpOnly&#xff0c;JavaScript \u662f\u65e0\u6cd5\u8bbf\u95ee\u8be5 Cookie \u7684\u3002<\/p>\n<h4>7.\u00a0Cookie \u4e0e\u8de8\u57df<\/h4>\n<p>Cookie \u9ed8\u8ba4 \u4e0d\u8de8\u57df&#xff0c;\u4f46\u6709\u7b56\u7565\u652f\u6301&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u524d\u63d0\u662f\u8bbe\u7f6e\u4e86 Access-Control-Allow-Credentials: true<\/p>\n<\/li>\n<li>\n<p>\u5ba2\u6237\u7aef\u8bf7\u6c42\u5fc5\u987b\u4f7f\u7528 withCredentials: true<\/p>\n<\/li>\n<li>\n<p>Cookie \u7684 Domain \u8bbe\u7f6e\u4e3a\u9876\u7ea7\u57df\u540d&#xff08;\u5982 .example.com&#xff09;<\/p>\n<\/li>\n<\/ul>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u5c5e\u6027\u7528\u9014\u662f\u5426\u53ef\u9632\u653b\u51fb<\/tr>\n<tbody>\n<tr>\n<td>HttpOnly<\/td>\n<td>\u7981\u6b62 JS \u8bbf\u95ee<\/td>\n<td>\u9632\u6b62 XSS<\/td>\n<\/tr>\n<tr>\n<td>Secure<\/td>\n<td>\u53ea\u5728 HTTPS \u4f20\u8f93<\/td>\n<td>\u9632\u6b62 MITM<\/td>\n<\/tr>\n<tr>\n<td>SameSite<\/td>\n<td>\u8de8\u7ad9\u8bf7\u6c42\u9650\u5236<\/td>\n<td>\u9632\u6b62 CSRF<\/td>\n<\/tr>\n<tr>\n<td>Expires<\/td>\n<td>\u63a7\u5236 Cookie \u5931\u6548\u65f6\u95f4<\/td>\n<td>\u63a7\u5236\u751f\u547d\u5468\u671f<\/td>\n<\/tr>\n<tr>\n<td>Domain<\/td>\n<td>\u63a7\u5236\u5b50\u57df\u53ef\u8bbf\u95ee<\/td>\n<td>\u6613\u88ab\u6ee5\u7528&#xff0c;\u5c0f\u5fc3\u8bbe\u7f6e<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u4e09\u3001Session\u8be6\u89e3<\/h3>\n<p>Session \u662f\u670d\u52a1\u5668\u7aef\u7528\u4e8e \u8bb0\u5f55\u5ba2\u6237\u7aef\u72b6\u6001 \u7684\u4e00\u79cd\u673a\u5236\u3002\u5b83\u89e3\u51b3\u4e86 HTTP \u534f\u8bae\u65e0\u72b6\u6001\u7684\u95ee\u9898&#xff08;\u670d\u52a1\u5668\u65e0\u6cd5\u8bb0\u4f4f\u6bcf\u4e2a\u7528\u6237\u662f\u8c01&#xff09;\u3002<\/p>\n<p>\u5ba2\u6237\u7aef\u767b\u5f55\u540e&#xff0c;\u670d\u52a1\u5668\u751f\u6210\u4e00\u4e2a Session ID&#xff0c;\u7528\u4e8e\u6807\u8bc6\u5f53\u524d\u4f1a\u8bdd&#xff0c;\u5e76\u5c06\u5b83\u4fdd\u5b58\u5728\u670d\u52a1\u7aef&#xff0c;\u540c\u65f6\u901a\u8fc7 Cookie \u53d1\u7ed9\u5ba2\u6237\u7aef\u3002\u5ba2\u6237\u7aef\u6bcf\u6b21\u8bf7\u6c42\u65f6\u643a\u5e26\u8fd9\u4e2a Session ID&#xff0c;\u670d\u52a1\u5668\u5c31\u80fd\u8bc6\u522b\u8be5\u7528\u6237\u662f\u8c01\u3002<\/p>\n<h4>1.\u00a0Session \u7684\u5de5\u4f5c\u6d41\u7a0b<\/h4>\n<p>[\u5ba2\u6237\u7aef] \u2014\u2014 \u767b\u5f55\u8bf7\u6c42 \u2014\u2014&gt; [\u670d\u52a1\u7aef]<br \/>\n                     &lt;\u2014\u2014 Set-Cookie: sessionid&#061;abc123 \u2014\u2014 <\/p>\n<p>[\u5ba2\u6237\u7aef] \u2014\u2014 \u540e\u7eed\u8bf7\u6c42&#xff08;\u5e26 Cookie&#xff09; \u2014\u2014&gt; [\u670d\u52a1\u7aef]<br \/>\n                         \u67e5\u627e sessionid&#061;abc123 \u5bf9\u5e94\u7684\u7528\u6237\u72b6\u6001<\/p>\n<p>\u793a\u4f8b\u6d41\u7a0b&#xff1a;<\/p>\n<li>\n<p>\u7528\u6237\u7b2c\u4e00\u6b21\u8bbf\u95ee\u7f51\u7ad9&#xff0c;\u670d\u52a1\u7aef\u521b\u5efa\u4e00\u4e2a\u65b0\u7684 Session&#xff0c;\u751f\u6210\u4e00\u4e2a\u552f\u4e00\u7684 sessionid<\/p>\n<\/li>\n<li>\n<p>\u670d\u52a1\u5668\u901a\u8fc7 Set-Cookie \u628a sessionid \u8bbe\u7f6e\u5230\u5ba2\u6237\u7aef\u6d4f\u89c8\u5668\u4e2d<\/p>\n<\/li>\n<li>\n<p>\u4e4b\u540e\u5ba2\u6237\u7aef\u8bf7\u6c42\u4e2d\u90fd\u4f1a\u81ea\u52a8\u643a\u5e26 Cookie: sessionid&#061;xxx<\/p>\n<\/li>\n<li>\n<p>\u670d\u52a1\u7aef\u6839\u636e sessionid \u5728\u5185\u5b58\/\u6570\u636e\u5e93\u4e2d\u67e5\u627e\u7528\u6237\u7684\u4f1a\u8bdd\u4fe1\u606f&#xff08;\u5982\u767b\u5f55\u72b6\u6001\u3001\u7528\u6237\u540d\u7b49&#xff09;<\/p>\n<\/li>\n<h4>2.\u00a0Session \u4e0e Cookie \u7684\u533a\u522b<\/h4>\n<table>\n<tr>\u9879\u76eeCookieSession<\/tr>\n<tbody>\n<tr>\n<td>\u5b58\u50a8\u4f4d\u7f6e<\/td>\n<td>\u5ba2\u6237\u7aef\u6d4f\u89c8\u5668<\/td>\n<td>\u670d\u52a1\u7aef\u5185\u5b58\u3001\u6570\u636e\u5e93\u3001Redis \u7b49<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u6027<\/td>\n<td>\u8f83\u4f4e&#xff0c;\u6613\u88ab\u76d7\u7528<\/td>\n<td>\u8f83\u9ad8&#xff0c;\u4e0d\u66b4\u9732\u7528\u6237\u6570\u636e&#xff0c;\u4ec5\u66b4\u9732 ID<\/td>\n<\/tr>\n<tr>\n<td>\u5bb9\u91cf\u9650\u5236<\/td>\n<td>\u6bcf\u4e2a Cookie \u6700\u5927\u7ea6 4KB<\/td>\n<td>\u8f83\u5927&#xff0c;\u53ef\u5b58\u50a8\u4efb\u610f\u590d\u6742\u7ed3\u6784<\/td>\n<\/tr>\n<tr>\n<td>\u751f\u547d\u5468\u671f<\/td>\n<td>\u8bbe\u7f6e Expires\/Max-Age \u63a7\u5236<\/td>\n<td>\u901a\u5e38\u5b58\u5728\u5185\u5b58\u4e2d&#xff0c;\u6d4f\u89c8\u5668\u5173\u95ed\u6216\u8fc7\u671f\u5931\u6548<\/td>\n<\/tr>\n<tr>\n<td>\u6613\u7528\u6027<\/td>\n<td>\u65e0\u9700\u670d\u52a1\u5668\u7aef\u8d44\u6e90<\/td>\n<td>\u9700\u8981\u670d\u52a1\u5668\u7ef4\u62a4 Session \u72b6\u6001<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>3.\u00a0Session \u5b58\u50a8\u673a\u5236<\/h4>\n<p>Session \u672c\u8d28\u662f\u4e00\u4e2a Key-Value \u7ed3\u6784&#xff1a;<\/p>\n<ul>\n<li>\n<p>Key \u662f sessionid&#xff08;\u4fdd\u5b58\u5728\u5ba2\u6237\u7aef Cookie \u4e2d&#xff09;<\/p>\n<\/li>\n<li>\n<p>Value \u662f\u670d\u52a1\u7aef\u4fdd\u5b58\u7684\u7528\u6237\u72b6\u6001\u4fe1\u606f&#xff08;\u4fdd\u5b58\u5728\u670d\u52a1\u5668&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>Session \u6570\u636e\u7684\u5b58\u50a8\u65b9\u5f0f\u5e38\u89c1\u5982\u4e0b&#xff1a;<\/p>\n<table>\n<tr>\u5b58\u50a8\u65b9\u5f0f\u7279\u70b9<\/tr>\n<tbody>\n<tr>\n<td>\u5185\u5b58&#xff08;\u9ed8\u8ba4&#xff09;<\/td>\n<td>\u7b80\u5355\u3001\u901f\u5ea6\u5feb&#xff0c;\u91cd\u542f\u4e22\u5931&#xff0c;\u4e0d\u53ef\u6269\u5c55<\/td>\n<\/tr>\n<tr>\n<td>\u6587\u4ef6<\/td>\n<td>\u5b58\u5728\u78c1\u76d8&#xff0c;\u53ef\u6301\u4e45&#xff0c;\u901f\u5ea6\u8f83\u6162<\/td>\n<\/tr>\n<tr>\n<td>\u6570\u636e\u5e93<\/td>\n<td>\u53ef\u6301\u4e45\u3001\u6613\u7ba1\u7406&#xff0c;\u6027\u80fd\u4e2d\u7b49<\/td>\n<\/tr>\n<tr>\n<td>Redis<\/td>\n<td>\u9ad8\u6027\u80fd\u5206\u5e03\u5f0f&#xff0c;\u9002\u5408\u9ad8\u5e76\u53d1\u573a\u666f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>4.\u00a0Session \u751f\u547d\u5468\u671f<\/h4>\n<ul>\n<li>\n<p>\u9ed8\u8ba4\u6709\u6548\u671f&#xff1a;\u6d4f\u89c8\u5668\u5173\u95ed\u65f6\u5931\u6548&#xff0c;\u6216\u670d\u52a1\u7aef\u8bbe\u5b9a\u8d85\u65f6\u65f6\u95f4&#xff08;\u5982 30 \u5206\u949f&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u8bbe\u7f6e\u65b9\u5f0f&#xff08;\u4ee5 PHP \u4e3a\u4f8b&#xff09;&#xff1a;<\/p>\n<\/li>\n<\/ul>\n<p>ini_set(&#039;session.gc_maxlifetime&#039;, 3600); \/\/ \u8bbe\u7f6e\u6709\u6548\u671f 1 \u5c0f\u65f6<br \/>\nsession_start();<\/p>\n<h4>5. Session \u5b89\u5168\u95ee\u9898\u4e0e\u653b\u51fb\u65b9\u5f0f<\/h4>\n<p>1&#xff09;Session Fixation&#xff08;\u56fa\u5b9a\u4f1a\u8bdd\u653b\u51fb&#xff09;<\/p>\n<p>\u653b\u51fb\u8005\u8bf1\u5bfc\u7528\u6237\u4f7f\u7528\u4e8b\u5148\u6784\u9020\u7684 sessionid&#xff0c;\u7136\u540e\u670d\u52a1\u5668\u5c06\u5176\u7ed1\u5b9a\u4e3a\u5408\u6cd5 Session\u3002<\/p>\n<p>\u4e3e\u4f8b&#xff1a;<\/p>\n<p>http:\/\/example.com\/login?PHPSESSID&#061;abc123<\/p>\n<p>\u7528\u6237\u70b9\u51fb\u540e\u767b\u5f55&#xff0c;\u653b\u51fb\u8005\u5c31\u53ef\u4ee5\u4f7f\u7528\u76f8\u540c Session ID \u767b\u5f55\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u767b\u5f55\u6210\u529f\u540e\u5f3a\u5236\u91cd\u65b0\u751f\u6210 Session ID<\/p>\n<\/li>\n<li>\n<p>\u62d2\u7edd URL \u4e2d\u4f20\u9012 Session ID&#xff08;\u7981\u6b62 SID&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u8bbe\u7f6e HttpOnly&#xff0c;\u7981\u7528 JS \u64cd\u4f5c Cookie<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;Session Hijacking&#xff08;\u52ab\u6301&#xff09;<\/p>\n<p>\u653b\u51fb\u8005\u901a\u8fc7 XSS\u3001\u6d41\u91cf\u55c5\u63a2\u3001\u6076\u610f\u6269\u5c55\u7b49\u624b\u6bb5\u83b7\u53d6\u7528\u6237\u7684 sessionid&#xff0c;\u7136\u540e\u4f2a\u9020\u8bf7\u6c42\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4f7f\u7528 Secure &#043; HttpOnly \u5c5e\u6027\u4fdd\u62a4 Cookie<\/p>\n<\/li>\n<li>\n<p>\u5168\u7ad9\u5f3a\u5236 HTTPS&#xff0c;\u9632\u6b62\u4e2d\u95f4\u4eba\u7a83\u53d6<\/p>\n<\/li>\n<li>\n<p>Session ID \u7ed1\u5b9a\u7528\u6237 UA\/IP&#xff0c;\u9632\u6b62\u4f2a\u9020<\/p>\n<\/li>\n<\/ul>\n<p>3&#xff09;\u4f1a\u8bdd\u8fc7\u671f\u653b\u51fb<\/p>\n<p>\u7528\u6237\u957f\u65f6\u95f4\u4e0d\u64cd\u4f5c&#xff0c;Session \u88ab\u9500\u6bc1&#xff0c;\u653b\u51fb\u8005\u5728\u8fd9\u4e2a\u65f6\u95f4\u53d1\u8d77\u8bf7\u6c42\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u8bbe\u7f6e\u5408\u7406\u7684 Session \u8fc7\u671f\u65f6\u95f4<\/p>\n<\/li>\n<li>\n<p>\u767b\u5f55\u524d\u7f6e\u9a8c\u8bc1 &#043; Session \u7ba1\u7406\u673a\u5236<\/p>\n<\/li>\n<\/ul>\n<h4>6.\u00a0\u5e38\u89c1 Session \u5b9e\u73b0\u65b9\u5f0f<\/h4>\n<p>PHP<\/p>\n<p>session_start(); \/\/ \u542f\u52a8 Session<br \/>\n$_SESSION[&#039;user&#039;] &#061; &#039;admin&#039;;<\/p>\n<p>Cookie \u81ea\u52a8\u8bbe\u7f6e&#xff1a;<\/p>\n<p>Set-Cookie: PHPSESSID&#061;abc123; path&#061;\/; HttpOnly <\/p>\n<p>Python Flask<\/p>\n<p>from flask import session<br \/>\nsession[&#039;user&#039;] &#061; &#039;admin&#039;<\/p>\n<p>\u9ed8\u8ba4\u4f7f\u7528 Cookie \u5b58\u50a8&#xff08;\u53ef\u914d\u7f6e\u4e3a Redis \u7b49&#xff09;<\/p>\n<p>Java Servlet<\/p>\n<p>HttpSession session &#061; request.getSession();<br \/>\nsession.setAttribute(&#034;user&#034;, &#034;admin&#034;);<\/p>\n<p>\u9ed8\u8ba4\u4f7f\u7528 JSESSIONID \u6765\u6807\u8bc6\u4f1a\u8bdd<\/p>\n<p>Set-Cookie: JSESSIONID&#061;abc123; Path&#061;\/; HttpOnly<\/p>\n<h4>7. Session \u7684\u9ad8\u7ea7\u5b89\u5168\u63a7\u5236<\/h4>\n<p>1&#xff09;Session ID \u5f3a\u5ea6<\/p>\n<ul>\n<li>\n<p>\u5e94\u8be5\u4f7f\u7528\u9ad8\u71b5\u7684\u968f\u673a\u503c\u751f\u6210&#xff08;\u5982 UUID\u3001SHA256 \u968f\u673a\u4e32&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4e0d\u8981\u4f7f\u7528\u7b80\u5355\u81ea\u589e\u6216\u53ef\u9884\u6d4b\u5b57\u7b26\u4e32<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;Session ID \u7ed1\u5b9a\u7b56\u7565<\/p>\n<p>\u7ed1\u5b9a\u5230\u4ee5\u4e0b\u4fe1\u606f\u53ef\u9632\u6b62\u4f2a\u9020&#xff1a;<\/p>\n<ul>\n<li>\n<p>User-Agent&#xff08;\u6d4f\u89c8\u5668\u6307\u7eb9&#xff09;<\/p>\n<\/li>\n<li>\n<p>IP \u5730\u5740&#xff08;\u4e0d\u5efa\u8bae\u7ed1\u5b9a\u5b8c\u6574 IP&#xff0c;\u53ef\u7ed1\u5b9a\u524d\u51e0\u6bb5&#xff09;<\/p>\n<\/li>\n<\/ul>\n<h4>8.\u00a0Session \u4e0e Token \u7684\u533a\u522b<\/h4>\n<table>\n<tr>\u9879\u76eeSessionToken&#xff08;\u5982 JWT&#xff09;<\/tr>\n<tbody>\n<tr>\n<td>\u5b58\u50a8<\/td>\n<td>\u670d\u52a1\u7aef<\/td>\n<td>\u5ba2\u6237\u7aef\u672c\u5730<\/td>\n<\/tr>\n<tr>\n<td>\u72b6\u6001<\/td>\n<td>\u6709\u72b6\u6001&#xff08;\u670d\u52a1\u7aef\u7ef4\u62a4\u4f1a\u8bdd&#xff09;<\/td>\n<td>\u65e0\u72b6\u6001&#xff08;\u4e0d\u9700\u8981\u5b58\u50a8&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u6027\u80fd<\/td>\n<td>\u5360\u7528\u5185\u5b58&#xff0c;\u6269\u5c55\u5dee<\/td>\n<td>\u9002\u5408\u5206\u5e03\u5f0f&#xff0c;\u591a\u7ec8\u7aef\u573a\u666f<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u6027<\/td>\n<td>\u53d7\u63a7\u4e8e\u670d\u52a1\u7aef&#xff0c;\u6cc4\u6f0f\u98ce\u9669\u4f4e<\/td>\n<td>\u9700\u8981\u52a0\u5bc6\u7b7e\u540d\u9a8c\u8bc1&#xff0c;\u9632\u6b62\u4f2a\u9020<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u6838\u5fc3\u8981\u7d20\u5185\u5bb9<\/tr>\n<tbody>\n<tr>\n<td>Session \u672c\u8d28<\/td>\n<td>\u7528\u4e8e\u670d\u52a1\u7aef\u4fdd\u5b58\u7528\u6237\u72b6\u6001&#xff0c;\u914d\u5408 Cookie \u8bc6\u522b\u8eab\u4efd<\/td>\n<\/tr>\n<tr>\n<td>Cookie \u4f5c\u7528<\/td>\n<td>\u5b58\u50a8 sessionid&#xff0c;\u6807\u8bc6\u7528\u6237\u662f\u8c01<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u5173\u952e\u70b9<\/td>\n<td>HttpOnly\u3001Secure\u3001SameSite\u3001\u91cd\u65b0\u751f\u6210 ID\u3001\u9632 Fixation<\/td>\n<\/tr>\n<tr>\n<td>\u653b\u51fb\u65b9\u5f0f<\/td>\n<td>Fixation\u3001Hijacking\u3001XSS\u3001CSRF<\/td>\n<\/tr>\n<tr>\n<td>\u9632\u5fa1\u65b9\u6cd5<\/td>\n<td>\u7ed1\u5b9a\u4fe1\u606f\u3001\u4f7f\u7528 HTTPS\u3001\u77ed\u671f\u6709\u6548\u671f\u3001\u9a8c\u8bc1\u6765\u6e90<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u56db\u3001Token\u8be6\u89e3<\/h3>\n<p>Token&#xff08;\u4ee4\u724c&#xff09;\u662f\u4e00\u79cd\u670d\u52a1\u7aef\u751f\u6210\u7684\u5b57\u7b26\u4e32&#xff0c;\u7528\u4e8e\u5ba2\u6237\u7aef\u8bbf\u95ee\u53d7\u4fdd\u62a4\u8d44\u6e90\u65f6 \u6807\u8bc6\u8eab\u4efd \u7684\u8ba4\u8bc1\u673a\u5236\u3002<\/p>\n<p>Token \u662f\u4e3a\u4e86\u89e3\u51b3\u4f20\u7edf Session \u9700\u8981\u5728\u670d\u52a1\u5668\u7ef4\u62a4\u7528\u6237\u72b6\u6001\u7684\u95ee\u9898&#xff08;\u5373\u201c\u6709\u72b6\u6001\u8ba4\u8bc1\u201d&#xff09;&#xff0c;\u800c\u5f15\u5165\u7684 \u65e0\u72b6\u6001\u8ba4\u8bc1\u65b9\u5f0f&#xff0c;\u5e7f\u6cdb\u7528\u4e8e&#xff1a;<\/p>\n<ul>\n<li>\n<p>Web \u524d\u540e\u7aef\u5206\u79bb\u9879\u76ee<\/p>\n<\/li>\n<li>\n<p>\u79fb\u52a8\u7aef\u3001APP \u767b\u5f55\u8ba4\u8bc1<\/p>\n<\/li>\n<li>\n<p>\u5206\u5e03\u5f0f\u8ba4\u8bc1&#xff08;\u5355\u70b9\u767b\u5f55&#xff09;<\/p>\n<\/li>\n<\/ul>\n<h4>1.\u00a0Token \u7684\u5de5\u4f5c\u6d41\u7a0b&#xff08;\u8ba4\u8bc1\u673a\u5236&#xff09;<\/h4>\n<p>[\u5ba2\u6237\u7aef] \u2014\u2014 \u767b\u5f55 \u2014\u2014&gt; [\u670d\u52a1\u7aef]<br \/>\n                    &lt;\u2014\u2014 \u8fd4\u56de Token \u2014\u2014 <\/p>\n<p>[\u5ba2\u6237\u7aef] \u2014\u2014 \u540e\u7eed\u8bf7\u6c42&#xff08;\u643a\u5e26 Token&#xff09; \u2014\u2014&gt; [\u670d\u52a1\u7aef]<br \/>\n                      \u9a8c\u8bc1 Token \u5408\u6cd5\u6027&#xff0c;\u8fd4\u56de\u6570\u636e<\/p>\n<p>\u5e38\u89c1\u4f20\u8f93\u65b9\u5f0f&#xff1a;<\/p>\n<p>\u8bf7\u6c42\u5934\u65b9\u5f0f&#xff08;\u63a8\u8350&#xff09;&#xff1a;<\/p>\n<p>Authorization: Bearer &lt;token&gt;<\/p>\n<p>URL \u53c2\u6570&#xff1a;<\/p>\n<p>GET \/api\/user?token&#061;abc123<\/p>\n<p>\u8bf7\u6c42\u4f53&#xff08;POST JSON&#xff09;\u4e2d\u63d0\u4ea4&#xff1a;<\/p>\n<p>{ &#034;token&#034;: &#034;abc123&#034; }<\/p>\n<h4>2. Token \u7684\u79cd\u7c7b<\/h4>\n<p>1&#xff09;\u81ea\u5b9a\u4e49 Token&#xff08;\u666e\u901a\u968f\u673a\u4e32&#xff09;<\/p>\n<ul>\n<li>\n<p>\u7ed3\u6784\u7b80\u5355&#xff1a;\u5982 abc123xyz456<\/p>\n<\/li>\n<li>\n<p>\u5b58\u5728 Redis\u3001\u6570\u636e\u5e93\u4e2d&#xff0c;\u548c Session \u7c7b\u4f3c<\/p>\n<\/li>\n<li>\n<p>\u6bcf\u6b21\u8bf7\u6c42\u670d\u52a1\u5668\u67e5\u4e00\u6b21\u6570\u636e\u5e93&#xff0c;\u9a8c\u8bc1\u5408\u6cd5\u6027<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;JWT&#xff08;JSON Web Token&#xff09;<\/p>\n<ul>\n<li>\n<p>\u65e0\u9700\u6570\u636e\u5e93\u67e5\u627e&#xff0c;\u4f7f\u7528\u7b7e\u540d\u6821\u9a8c\u5373\u53ef<\/p>\n<\/li>\n<li>\n<p>\u5e38\u7528\u4e8e\u5206\u5e03\u5f0f\u8ba4\u8bc1\u3001\u524d\u540e\u7aef\u5206\u79bb\u7cfb\u7edf<\/p>\n<\/li>\n<\/ul>\n<h4>3.\u00a0JWT \u7684\u7ed3\u6784<\/h4>\n<p>xxxxx.yyyyy.zzzzz<\/p>\n<p>\u7531\u4e09\u90e8\u5206\u7ec4\u6210&#xff0c;\u6bcf\u90e8\u5206\u4f7f\u7528 Base64 \u7f16\u7801&#xff1a;<\/p>\n<table>\n<tr>\u90e8\u5206\u5185\u5bb9\u793a\u4f8b<\/tr>\n<tbody>\n<tr>\n<td>Header<\/td>\n<td>\u4ee4\u724c\u7c7b\u578b &#043; \u7b7e\u540d\u7b97\u6cd5<\/td>\n<td>{ &#034;alg&#034;: &#034;HS256&#034;, &#034;typ&#034;: &#034;JWT&#034; }<\/td>\n<\/tr>\n<tr>\n<td>Payload<\/td>\n<td>\u8f7d\u8377&#xff08;\u7528\u6237\u4fe1\u606f&#xff09;<\/td>\n<td>{ &#034;uid&#034;: 1001, &#034;role&#034;: &#034;admin&#034; }<\/td>\n<\/tr>\n<tr>\n<td>Signature<\/td>\n<td>\u7b7e\u540d&#xff08;\u9632\u7be1\u6539&#xff09;<\/td>\n<td>HMAC_SHA256(header &#043; payload &#043; \u5bc6\u94a5)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u4e3e\u4f8b&#xff1a;<\/p>\n<p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9. \/\/ Header<br \/>\neyJ1aWQiOjEsInJvbGUiOiJhZG1pbiJ9.      \/\/ Payload<br \/>\nAbcdefghijklmnopqrstuvwxyz123456      \/\/ Signature<\/p>\n<h4>4.\u00a0Token \u4e0e Session \u7684\u533a\u522b<\/h4>\n<table>\n<tr>\u9879\u76eeSessionToken&#xff08;JWT&#xff09;<\/tr>\n<tbody>\n<tr>\n<td>\u5b58\u50a8\u65b9\u5f0f<\/td>\n<td>\u670d\u52a1\u5668\u5185\u5b58\u3001\u6570\u636e\u5e93<\/td>\n<td>\u5ba2\u6237\u7aef\u672c\u5730&#xff08;\u65e0\u72b6\u6001&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u6807\u8bc6\u673a\u5236<\/td>\n<td>sessionid &#043; \u670d\u52a1\u7aef\u72b6\u6001\u8bb0\u5f55<\/td>\n<td>Token \u81ea\u5e26\u7528\u6237\u4fe1\u606f &#043; \u7b7e\u540d\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>\u6027\u80fd<\/td>\n<td>\u670d\u52a1\u7aef\u9700\u67e5\u72b6\u6001&#xff0c;\u6a2a\u5411\u6269\u5c55\u5dee<\/td>\n<td>\u4e0d\u4f9d\u8d56\u670d\u52a1\u7aef\u72b6\u6001&#xff0c;\u6613\u4e8e\u5206\u5e03\u5f0f\u90e8\u7f72<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u6027<\/td>\n<td>\u4e0d\u6cc4\u6f0f\u7528\u6237\u4fe1\u606f&#xff0c;\u670d\u52a1\u7aef\u63a7\u5236\u8f83\u5f3a<\/td>\n<td>\u7528\u6237\u4fe1\u606f\u76f4\u63a5\u66b4\u9732\u5728 Payload \u4e2d<\/td>\n<\/tr>\n<tr>\n<td>\u53ef\u63a7\u6027<\/td>\n<td>\u670d\u52a1\u7aef\u53ef\u624b\u52a8\u9500\u6bc1\u3001\u4fee\u6539<\/td>\n<td>\u4e00\u65e6\u53d1\u51fa\u4e0d\u53ef\u64a4\u9500&#xff0c;\u9700\u8bbe\u7f6e\u8fc7\u671f\u65f6\u95f4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>5.\u00a0Token \u7684\u4f18\u70b9\u4e0e\u7f3a\u70b9<\/h4>\n<p>\u00a0\u4f18\u70b9&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u65e0\u9700\u670d\u52a1\u7aef\u4fdd\u5b58\u72b6\u6001&#xff08;\u8282\u7701\u8d44\u6e90&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u53ef\u8de8\u670d\u52a1\u3001\u8de8\u5e73\u53f0\u5171\u4eab\u8eab\u4efd&#xff08;\u5982 SSO \u5355\u70b9\u767b\u5f55&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4e0d\u4f9d\u8d56 Cookie&#xff0c;\u53ef\u7528\u4e8e\u79fb\u52a8\u7aef\u3001App<\/p>\n<\/li>\n<\/ul>\n<p>\u7f3a\u70b9&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u65e0\u6cd5\u4e3b\u52a8\u5931\u6548&#xff08;Token \u53d1\u51fa\u540e\u65e0\u6cd5\u6536\u56de&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4fe1\u606f\u5bb9\u6613\u6cc4\u6f0f&#xff08;Payload \u660e\u6587&#xff0c;\u9700\u52a0\u5bc6\u654f\u611f\u5b57\u6bb5&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4f53\u79ef\u5927\u4e8e Session ID&#xff0c;\u5360\u5e26\u5bbd<\/p>\n<\/li>\n<\/ul>\n<h4>6.\u00a0Token \u7684\u5b58\u50a8\u65b9\u5f0f<\/h4>\n<table>\n<tr>\u5b58\u50a8\u65b9\u5f0f\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>LocalStorage<\/td>\n<td>\u6301\u4e45\u6027\u5f3a&#xff0c;\u4f46\u6613\u88ab XSS \u653b\u51fb<\/td>\n<\/tr>\n<tr>\n<td>SessionStorage<\/td>\n<td>\u6d4f\u89c8\u5668\u5173\u95ed\u5373\u6e05\u9664&#xff0c;\u5b89\u5168\u7565\u9ad8<\/td>\n<\/tr>\n<tr>\n<td>Cookie<\/td>\n<td>\u53ef\u914d\u5408 HttpOnly &#043; Secure \u63d0\u5347\u5b89\u5168<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.\u00a0Token \u7684\u5b89\u5168\u95ee\u9898\u4e0e\u653b\u51fb\u65b9\u5f0f<\/h4>\n<p>1&#xff09;Token \u6cc4\u6f0f&#xff08;XSS\u3001\u65e5\u5fd7\u66b4\u9732&#xff09;<\/p>\n<ul>\n<li>\n<p>Token \u901a\u5e38\u4fdd\u5b58\u5728\u6d4f\u89c8\u5668\u4e2d&#xff0c;\u82e5\u5b58\u5728 XSS \u6f0f\u6d1e&#xff0c;\u653b\u51fb\u8005\u53ef\u8f7b\u677e\u83b7\u53d6<\/p>\n<\/li>\n<li>\n<p>URL \u4e2d\u4f20\u9012 Token \u53ef\u80fd\u88ab\u65e5\u5fd7\u3001\u4ee3\u7406\u670d\u52a1\u5668\u8bb0\u5f55<\/p>\n<\/li>\n<\/ul>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>Token \u4e0d\u51fa\u73b0\u5728 URL&#xff0c;\u63a8\u8350\u653e\u5728 Header<\/p>\n<\/li>\n<li>\n<p>\u5b58\u50a8 Token \u65f6\u907f\u514d\u4f7f\u7528 localStorage&#xff08;\u63a8\u8350 HttpOnly Cookie&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u524d\u7aef\u9632 XSS&#xff1a;\u4e25\u683c CSP &#043; DOM \u8fc7\u6ee4<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;Token \u4f2a\u9020<\/p>\n<ul>\n<li>\n<p>\u653b\u51fb\u8005\u5c1d\u8bd5\u4f2a\u9020 JWT&#xff0c;\u7ed5\u8fc7\u8ba4\u8bc1<\/p>\n<\/li>\n<\/ul>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4f7f\u7528\u5f3a\u52a0\u5bc6\u7b97\u6cd5&#xff08;\u5982 HMAC-SHA256&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4e25\u683c\u4fdd\u7ba1\u5bc6\u94a5&#xff0c;\u4e0d\u5e94\u6cc4\u6f0f\u670d\u52a1\u7aef\u5bc6\u94a5<\/p>\n<\/li>\n<\/ul>\n<p>3&#xff09;Token \u91cd\u653e\u653b\u51fb&#xff08;Replay&#xff09;<\/p>\n<ul>\n<li>\n<p>\u653b\u51fb\u8005\u622a\u83b7\u5408\u6cd5\u8bf7\u6c42 Token \u540e&#xff0c;\u5728\u6709\u6548\u671f\u5185\u91cd\u590d\u4f7f\u7528<\/p>\n<\/li>\n<\/ul>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>Token \u8bbe\u7f6e\u77ed\u6709\u6548\u671f&#xff08;\u5982 5 \u5206\u949f&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u914d\u5408 \u4e00\u6b21\u6027 Token \/ RefreshToken \u673a\u5236<\/p>\n<\/li>\n<\/ul>\n<h4>8.\u00a0Token \u4e0e Refresh Token \u673a\u5236<\/h4>\n<p>\u7531\u4e8e Token \u4e0d\u53ef\u64a4\u9500&#xff0c;\u63a8\u8350\u4f7f\u7528\u53cc Token \u673a\u5236&#xff1a;<\/p>\n<table>\n<tr>\u7c7b\u578b\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>Access Token<\/td>\n<td>\u6709\u6548\u671f\u77ed&#xff0c;\u7528\u4e8e\u8bf7\u6c42\u63a5\u53e3<\/td>\n<\/tr>\n<tr>\n<td>Refresh Token<\/td>\n<td>\u6709\u6548\u671f\u957f&#xff0c;\u7528\u4e8e\u6362\u53d6\u65b0 Token<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u6d41\u7a0b&#xff1a;<\/p>\n<p>[\u767b\u5f55] \u2014\u2014&gt; [\u53d1\u51fa access_token &#043; refresh_token]<\/p>\n<p>[\u8bf7\u6c42\u8d44\u6e90] \u2014\u2014&gt; \u9644\u5e26 access_token<br \/>\n   |<br \/>\n   \u2514\u2500\u2500[\u8fc7\u671f]\u2014\u2014&gt; \u7528 refresh_token \u6362\u65b0\u7684 access_token<\/p>\n<h4>9.\u00a0\u5b9e\u6218\u793a\u4f8b&#xff1a;\u4f7f\u7528 JWT \u9a8c\u8bc1\u8eab\u4efd<\/h4>\n<p>\u524d\u7aef\u8bf7\u6c42&#xff1a;<\/p>\n<p>POST \/login<br \/>\nContent-Type: application\/json<\/p>\n<p>{<br \/>\n  &#034;username&#034;: &#034;admin&#034;,<br \/>\n  &#034;password&#034;: &#034;123456&#034;<br \/>\n}<\/p>\n<p>\u670d\u52a1\u7aef\u8fd4\u56de&#xff1a;<\/p>\n<p>{<br \/>\n  &#034;token&#034;: &#034;eyJhbGciOiJIUzI1NiIsInR5c&#8230;&#034;<br \/>\n}<\/p>\n<p>\u540e\u7eed\u8bf7\u6c42\u9644\u5e26&#xff1a;<\/p>\n<p>GET \/user\/info<br \/>\nAuthorization: Bearer eyJhbGciOiJIUzI1NiIsInR5c&#8230;<\/p>\n<p>\u670d\u52a1\u7aef\u7528\u5bc6\u94a5\u9a8c\u8bc1 Token \u7b7e\u540d&#xff0c;\u8bfb\u53d6\u5176\u4e2d\u7684 Payload \u4fe1\u606f&#xff0c;\u5224\u65ad\u7528\u6237\u8eab\u4efd\u3002<\/p>\n<h4>10.\u00a0Token \u793a\u4f8b\u5206\u6790&#xff08;JWT \u89e3\u7801&#xff09;<\/h4>\n<p>\u793a\u4f8b JWT&#xff1a;<\/p>\n<p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.<br \/>\neyJ1aWQiOjEsInJvbGUiOiJhZG1pbiIsImV4cCI6MTY5ODQzMjAwMH0.<br \/>\nt7I8mVYuqxPhA5KXZMQzN2gUe9eWYmN2coHo5cVdE2g<\/p>\n<p>\u89e3\u7801 Payload \u5f97\u5230&#xff1a;<\/p>\n<p>{<br \/>\n  &#034;uid&#034;: 1,<br \/>\n  &#034;role&#034;: &#034;admin&#034;,<br \/>\n  &#034;exp&#034;: 1698432000<br \/>\n}<\/p>\n<p>\u8bf4\u660e\u7528\u6237 ID \u4e3a 1&#xff0c;\u89d2\u8272\u4e3a admin&#xff0c;\u6709\u6548\u671f\u622a\u6b62\u65f6\u95f4\u4e3a\u67d0\u4e2a\u65f6\u95f4\u6233&#xff08;\u53ef\u7528 Python\/JS \u89e3\u7801&#xff09;\u3002<\/p>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u8981\u7d20\u5185\u5bb9\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u6838\u5fc3\u673a\u5236<\/td>\n<td>\u5ba2\u6237\u7aef\u6301\u6709 Token&#xff0c;\u670d\u52a1\u7aef\u9a8c\u8bc1\u7b7e\u540d&#xff0c;\u65e0\u9700\u72b6\u6001\u5b58\u50a8<\/td>\n<\/tr>\n<tr>\n<td>\u63a8\u8350\u65b9\u6848<\/td>\n<td>\u4f7f\u7528 JWT &#043; RefreshToken \u5b9e\u73b0\u5b89\u5168\u3001\u53ef\u6269\u5c55\u7684\u8ba4\u8bc1\u673a\u5236<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u98ce\u9669<\/td>\n<td>XSS\u3001Token \u6cc4\u6f0f\u3001\u4f2a\u9020\u3001\u91cd\u653e\u653b\u51fb\u7b49<\/td>\n<\/tr>\n<tr>\n<td>\u9632\u5fa1\u7b56\u7565<\/td>\n<td>HttpOnly Cookie \/ Token \u52a0\u5bc6 \/ \u8fc7\u671f\u673a\u5236 \/ \u52a0\u7b7e\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>\u4e0e Session \u533a\u522b<\/td>\n<td>Token \u662f\u65e0\u72b6\u6001\u7684&#xff0c;\u9002\u5408\u5206\u5e03\u5f0f\u7cfb\u7edf&#xff1b;Session \u4f9d\u8d56\u670d\u52a1\u7aef\u5b58\u50a8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u4e94\u3001JWT \u7684\u673a\u5236\u4e0e\u653b\u51fb\u65b9\u5f0f<\/h3>\n<p>JWT \u5168\u79f0 JSON Web Token&#xff0c;\u662f\u4e00\u79cd \u65e0\u72b6\u6001\u7684\u8eab\u4efd\u9a8c\u8bc1\u673a\u5236&#xff0c;\u4e3b\u8981\u7528\u4e8e\u524d\u540e\u7aef\u5206\u79bb\u9879\u76ee\u3001\u79fb\u52a8\u7aef\u63a5\u53e3\u8c03\u7528\u3001\u5355\u70b9\u767b\u5f55&#xff08;SSO&#xff09;\u7b49\u3002<\/p>\n<p>\u5b83\u672c\u8d28\u4e0a\u662f\u4e00\u4e2a\u81ea\u5305\u542b\u7684\u4ee4\u724c&#xff0c;\u901a\u8fc7\u6570\u5b57\u7b7e\u540d\u7684\u65b9\u5f0f\u9632\u6b62\u7be1\u6539\u3002<\/p>\n<h4>1.\u00a0JWT \u7684\u7ed3\u6784&#xff08;\u4e09\u6bb5\u5f0f&#xff09;<\/h4>\n<p>\u683c\u5f0f\u5982\u4e0b&#xff1a;<\/p>\n<p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOjEsInJvbGUiOiJhZG1pbiJ9.WfJ9oX7O1fFLjlR_pIRpZI&#8230;<\/p>\n<p>\u7531 Header.Payload.Signature \u4e09\u90e8\u5206\u7ec4\u6210&#xff0c;\u6bcf\u90e8\u5206\u4f7f\u7528 Base64 \u7f16\u7801\u3002<\/p>\n<table>\n<tr>\u540d\u79f0\u5185\u5bb9\u7c7b\u578b\u4f5c\u7528<\/tr>\n<tbody>\n<tr>\n<td>Header<\/td>\n<td>\u5143\u6570\u636e&#xff08;\u7b97\u6cd5\u7c7b\u578b&#xff09;<\/td>\n<td>\u6307\u5b9a\u52a0\u5bc6\u7b97\u6cd5&#xff0c;\u5982 HS256 \/ RS256<\/td>\n<\/tr>\n<tr>\n<td>Payload<\/td>\n<td>\u8d1f\u8f7d&#xff08;\u7528\u6237\u4fe1\u606f&#xff09;<\/td>\n<td>\u5305\u542b\u7528\u6237\u8eab\u4efd\u3001\u6743\u9650\u3001\u8fc7\u671f\u65f6\u95f4\u7b49<\/td>\n<\/tr>\n<tr>\n<td>Signature<\/td>\n<td>\u7b7e\u540d&#xff08;\u5b8c\u6574\u6027\u9a8c\u8bc1&#xff09;<\/td>\n<td>\u9632\u6b62\u7be1\u6539&#xff0c;\u9a8c\u8bc1 Token \u662f\u5426\u6709\u6548<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2.\u00a0JWT \u7b7e\u540d\u673a\u5236&#xff08;\u6838\u5fc3&#xff09;<\/h4>\n<p>\u7b7e\u540d\u751f\u6210\u516c\u5f0f\u5982\u4e0b&#xff08;\u4ee5 HMAC-SHA256 \u4e3a\u4f8b&#xff09;&#xff1a;<\/p>\n<p>Signature &#061; HMAC-SHA256(<br \/>\n    base64url(Header) &#043; &#034;.&#034; &#043; base64url(Payload),<br \/>\n    secret_key<br \/>\n)<\/p>\n<p>\u8fd9\u4e2a\u7b7e\u540d\u53ef\u4ee5\u4fdd\u8bc1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u5185\u5bb9\u88ab\u7be1\u6539 \u2192 \u7b7e\u540d\u6821\u9a8c\u5931\u8d25<\/p>\n<\/li>\n<li>\n<p>\u5ba2\u6237\u7aef\u4e0d\u80fd\u4f2a\u9020 Token&#xff08;\u4e0d\u77e5\u9053\u5bc6\u94a5&#xff09;<\/p>\n<\/li>\n<\/ul>\n<h4>3.\u00a0JWT \u7684\u4f7f\u7528\u6d41\u7a0b<\/h4>\n<p>[\u7528\u6237\u767b\u5f55] \u2192 [\u751f\u6210 JWT] \u2192 \u8fd4\u56de\u7ed9\u524d\u7aef<br \/>\n       \u2193<br \/>\n[\u5ba2\u6237\u7aef] \u6301\u6709 JWT \u8c03\u7528\u63a5\u53e3<br \/>\n       \u2193<br \/>\n[\u670d\u52a1\u5668] \u9a8c\u8bc1 JWT \u7684\u7b7e\u540d \u2192 \u8bfb\u53d6 Payload \u2192 \u5141\u8bb8\u8bbf\u95ee<\/p>\n<h4>4.\u00a0Payload \u793a\u4f8b<\/h4>\n<p>{<br \/>\n  &#034;uid&#034;: 123,<br \/>\n  &#034;username&#034;: &#034;admin&#034;,<br \/>\n  &#034;role&#034;: &#034;super_admin&#034;,<br \/>\n  &#034;exp&#034;: 1710000000   \/\/ \u8fc7\u671f\u65f6\u95f4&#xff0c;Unix \u65f6\u95f4\u6233<br \/>\n}<\/p>\n<p>\u6ce8\u610f&#xff1a;<\/p>\n<ul>\n<li>\n<p>Payload \u4e0d\u80fd\u52a0\u5bc6&#xff0c;\u9ed8\u8ba4\u662f\u660e\u6587<\/p>\n<\/li>\n<li>\n<p>\u4e0d\u5e94\u653e\u654f\u611f\u6570\u636e&#xff08;\u5982\u5bc6\u7801\u3001\u94f6\u884c\u5361\u7b49&#xff09;<\/p>\n<\/li>\n<\/ul>\n<h4>5.\u00a0JWT \u653b\u51fb\u65b9\u5f0f&#xff08;\u9ed1\u5ba2\u89c6\u89d2&#xff09;<\/h4>\n<p>WT \u662f\u65e0\u72b6\u6001\u7684&#xff0c;\u4e00\u65e6\u7b7e\u53d1\u5c31\u65e0\u6cd5\u64a4\u9500&#xff0c;\u5982\u679c\u5b58\u5728\u914d\u7f6e\u95ee\u9898\u6216\u5f31\u5bc6\u94a5&#xff0c;\u653b\u51fb\u8005\u53ef\u4ee5\u4f2a\u9020\/\u7be1\u6539 JWT\u3002<\/p>\n<p>\u5e38\u89c1\u653b\u51fb\u65b9\u5f0f&#xff1a;<\/p>\n<p>1&#xff09;\u5f31\u5bc6\u94a5\u7206\u7834\u653b\u51fb&#xff08;HS256&#xff09;<\/p>\n<ul>\n<li>\n<p>\u5f53\u670d\u52a1\u7aef\u4f7f\u7528\u5bf9\u79f0\u52a0\u5bc6&#xff08;\u5982 HS256&#xff09;&#xff0c;\u5982\u679c\u5bc6\u94a5\u8fc7\u4e8e\u7b80\u5355&#xff0c;\u5982 123456&#xff0c;\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u5de5\u5177\u66b4\u529b\u7206\u7834\u3002<\/p>\n<\/li>\n<\/ul>\n<p>\u5de5\u5177&#xff1a;<\/p>\n<ul>\n<li>\n<p>jwt-cracker<\/p>\n<\/li>\n<li>\n<p>jwt_tool.py<\/p>\n<\/li>\n<\/ul>\n<p>jwt_tool.py &lt;token&gt; -C -d \/path\/to\/weak_passwords.txt<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4f7f\u7528\u590d\u6742\u4e0d\u53ef\u9884\u6d4b\u7684\u5bc6\u94a5&#xff08;\u5982 UUID &#043; \u9ad8\u4f4d\u968f\u673a&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4f7f\u7528\u975e\u5bf9\u79f0\u52a0\u5bc6&#xff08;RS256&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;\u7b97\u6cd5\u6df7\u6dc6\u653b\u51fb&#xff08;alg: none&#xff09;<\/p>\n<p>\u6709\u4e9b\u670d\u52a1\u7aef\u5bf9 JWT \u7684 alg \u5b57\u6bb5\u6ca1\u6709\u505a\u6821\u9a8c&#xff0c;\u5982\u679c\u7528\u6237\u5c06\u5176\u4fee\u6539\u4e3a &#034;alg&#034;: &#034;none&#034;&#xff0c;\u670d\u52a1\u7aef\u5c31\u4f1a\u8df3\u8fc7\u7b7e\u540d\u9a8c\u8bc1\u3002<\/p>\n<p>\u653b\u51fb\u65b9\u5f0f&#xff1a;<\/p>\n<p>\u7be1\u6539 Header \u4e3a&#xff1a;<\/p>\n<p>{ &#034;alg&#034;: &#034;none&#034;, &#034;typ&#034;: &#034;JWT&#034; }<\/p>\n<p>\u5220\u9664\u7b7e\u540d\u90e8\u5206&#xff0c;\u63d0\u4ea4\u4f2a\u9020 Token\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u62d2\u7edd &#034;alg&#034;: &#034;none&#034;&#xff0c;\u663e\u5f0f\u9a8c\u8bc1\u7b7e\u540d\u7b97\u6cd5<\/p>\n<\/li>\n<li>\n<p>\u4f7f\u7528\u7ecf\u8fc7\u9a8c\u8bc1\u7684 JWT \u5e93<\/p>\n<\/li>\n<\/ul>\n<p>3&#xff09;\u7b97\u6cd5\u66ff\u6362\u653b\u51fb&#xff08;HS256 \u2192 RS256&#xff09;<\/p>\n<p>RS256 \u662f\u975e\u5bf9\u79f0\u52a0\u5bc6&#xff08;\u516c\u79c1\u94a5&#xff09;&#xff0c;\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u7b97\u6cd5\u66ff\u6362\u7ed5\u8fc7\u9a8c\u8bc1\u3002<\/p>\n<p>\u653b\u51fb\u539f\u7406&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u670d\u52a1\u7aef\u4f7f\u7528 RS256&#xff0c;\u4f46\u653b\u51fb\u8005\u5c06 alg \u6539\u4e3a HS256&#xff0c;\u5e76\u7528\u201c\u516c\u94a5\u201d\u4ee3\u66ff\u201c\u5bc6\u94a5\u201d\u6765\u7b7e\u540d<\/p>\n<\/li>\n<li>\n<p>\u5982\u679c\u670d\u52a1\u7aef\u4ecd\u7528\u516c\u94a5\u9a8c\u8bc1&#xff0c;\u4f1a\u88ab\u6210\u529f\u9a8c\u8bc1\u7b7e\u540d<\/p>\n<\/li>\n<\/ul>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u56fa\u5b9a\u7b7e\u540d\u7b97\u6cd5&#xff0c;\u4e0d\u5141\u8bb8\u524d\u7aef\u6307\u5b9a alg<\/p>\n<\/li>\n<li>\n<p>\u4f7f\u7528\u4e25\u683c\u7684\u9a8c\u8bc1\u5e93&#xff08;\u5982 PyJWT, jsonwebtoken&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>4&#xff09;Token \u91cd\u653e\u653b\u51fb<\/p>\n<p>\u5373\u653b\u51fb\u8005\u622a\u83b7\u67d0\u7528\u6237\u7684\u5408\u6cd5 Token&#xff08;\u901a\u8fc7 XSS\u3001\u4e2d\u95f4\u4eba\u653b\u51fb\u3001URL \u6cc4\u6f0f\u7b49\u65b9\u5f0f&#xff09;&#xff0c;\u7136\u540e\u5728\u6709\u6548\u671f\u5185\u91cd\u590d\u4f7f\u7528\u3002<\/p>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4f7f\u7528 HTTPS \u52a0\u5bc6\u4f20\u8f93<\/p>\n<\/li>\n<li>\n<p>\u8bbe\u7f6e\u77ed\u7684\u6709\u6548\u671f&#xff08;exp&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u5f15\u5165 Refresh Token &#043; \u6ed1\u52a8\u8fc7\u671f\u673a\u5236<\/p>\n<\/li>\n<li>\n<p>\u7ed1\u5b9a IP \/ UA \u68c0\u67e5<\/p>\n<\/li>\n<\/ul>\n<p>5&#xff09;JWT \u6cc4\u6f0f\u653b\u51fb<\/p>\n<p>\u6cc4\u6f0f\u9014\u5f84&#xff1a;<\/p>\n<ul>\n<li>\n<p>Token \u5b58\u5728 URL \u4e2d&#xff0c;\u5bb9\u6613\u88ab\u6d4f\u89c8\u5668\u7f13\u5b58\u3001\u4e2d\u95f4\u4ef6\u8bb0\u5f55<\/p>\n<\/li>\n<li>\n<p>Token \u5b58\u50a8\u5728 localStorage&#xff0c;\u5bb9\u6613\u88ab XSS \u62ff\u5230<\/p>\n<\/li>\n<\/ul>\n<p>\u9632\u5fa1&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u63a8\u8350\u4f7f\u7528 Cookie &#043; HttpOnly &#043; Secure \u5b58\u50a8 JWT<\/p>\n<\/li>\n<li>\n<p>\u907f\u514d\u5728 URL \u4e2d\u4f20\u9012 Token<\/p>\n<\/li>\n<li>\n<p>\u542f\u7528 CSP\u3001\u8f93\u5165\u6821\u9a8c\u9632 XSS<\/p>\n<\/li>\n<\/ul>\n<h4>6.\u00a0\u6e17\u900f\u6d4b\u8bd5\u89c6\u89d2&#xff1a;JWT \u68c0\u6d4b\u70b9<\/h4>\n<p>\u5728\u6e17\u900f\u6d4b\u8bd5\/CTF \u4e2d&#xff0c;\u9047\u5230 JWT \u53ef\u4ee5\u91cd\u70b9\u68c0\u67e5\u4ee5\u4e0b\u70b9&#xff1a;<\/p>\n<table>\n<tr>\u68c0\u6d4b\u70b9\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>alg \u662f\u5426\u4e3a none<\/td>\n<td>\u662f\u5426\u80fd\u8df3\u8fc7\u7b7e\u540d\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>alg \u80fd\u5426\u66ff\u6362\u4e3a HS256<\/td>\n<td>\u80fd\u5426\u4f7f\u7528\u516c\u94a5\u4f2a\u9020\u7b7e\u540d<\/td>\n<\/tr>\n<tr>\n<td>\u5bc6\u94a5\u662f\u5426\u53ef\u7206\u7834<\/td>\n<td>\u4f7f\u7528\u5b57\u5178\u5de5\u5177\u5c1d\u8bd5\u7206\u7834<\/td>\n<\/tr>\n<tr>\n<td>payload \u662f\u5426\u53ef\u63a7<\/td>\n<td>\u662f\u5426\u80fd\u63d0\u6743&#xff08;role&#061;admin&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u8fc7\u671f\u65f6\u95f4\u662f\u5426\u6709\u6548<\/td>\n<td>\u662f\u5426\u80fd\u4fee\u6539 exp \u7ed5\u8fc7\u6821\u9a8c<\/td>\n<\/tr>\n<tr>\n<td>\u662f\u5426\u7ed1\u5b9a IP \/ UA<\/td>\n<td>\u662f\u5426\u53ef\u8fdb\u884c\u91cd\u653e\u653b\u51fb<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.\u00a0JWT \u653b\u51fb\u5b9e\u6218&#xff1a;\u6a21\u62df\u63d0\u6743\u653b\u51fb<\/h4>\n<p>1&#xff09;\u6293\u53d6\u4e00\u6bb5\u6b63\u5e38\u7528\u6237\u7684 Token&#xff1a;<\/p>\n<p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.<br \/>\neyJ1c2VyIjoiZ3Vlc3QiLCJyb2xlIjoiZ3Vlc3QifQ.<br \/>\nZV1HG9mU_kPvEZfukOVsfAz1-r4PHiZ93KAjtz07Gb0<\/p>\n<p>2&#xff09;\u89e3\u7801 Payload \u5e76\u4fee\u6539\u89d2\u8272\u5b57\u6bb5\u4e3a&#xff1a;<\/p>\n<p>{ &#034;user&#034;: &#034;guest&#034;, &#034;role&#034;: &#034;admin&#034; }<\/p>\n<p>3&#xff09;\u4f7f\u7528\u5f31\u5bc6\u94a5\u7206\u7834\u7b7e\u540d\u6216\u5c1d\u8bd5\u7b97\u6cd5\u66ff\u6362&#xff0c;\u91cd\u65b0\u751f\u6210 JWT\u3002<\/p>\n<p>4&#xff09;\u7528\u7be1\u6539\u540e\u7684 JWT \u8bbf\u95ee\u7ba1\u7406\u5458\u63a5\u53e3&#xff0c;\u5224\u65ad\u662f\u5426\u6210\u529f\u63d0\u6743\u3002<\/p>\n<h4>8.\u00a0\u9632\u5fa1\u6700\u4f73\u5b9e\u8df5<\/h4>\n<table>\n<tr>\u63aa\u65bd\u63cf\u8ff0<\/tr>\n<tbody>\n<tr>\n<td>\u56fa\u5b9a\u7b7e\u540d\u7b97\u6cd5<\/td>\n<td>\u4e0d\u5141\u8bb8\u524d\u7aef\u901a\u8fc7 Header \u63a7\u5236 alg<\/td>\n<\/tr>\n<tr>\n<td>\u4e0d\u4f7f\u7528 none \u7b97\u6cd5<\/td>\n<td>\u62d2\u7edd\u65e0\u7b7e\u540d JWT<\/td>\n<\/tr>\n<tr>\n<td>\u4f7f\u7528\u975e\u5bf9\u79f0\u52a0\u5bc6&#xff08;RS256&#xff09;<\/td>\n<td>\u907f\u514d\u5bc6\u94a5\u6cc4\u6f0f<\/td>\n<\/tr>\n<tr>\n<td>\u8bbe\u7f6e exp\/iatt\/nbf \u7b49\u5b57\u6bb5<\/td>\n<td>\u63a7\u5236\u6709\u6548\u671f\u3001\u62d2\u7edd\u8fc7\u671f Token<\/td>\n<\/tr>\n<tr>\n<td>\u914d\u7f6e\u77ed\u6709\u6548\u671f &#043; Refresh\u673a\u5236<\/td>\n<td>Access Token &#043; Refresh Token \u7ec4\u5408\u4f7f\u7528<\/td>\n<\/tr>\n<tr>\n<td>\u4f7f\u7528 HttpOnly Cookie<\/td>\n<td>\u9632\u6b62 JS \u83b7\u53d6 Token&#xff08;\u6297 XSS&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u8f93\u5165\u8fc7\u6ee4 &#043; CSP<\/td>\n<td>\u9632 XSS \u653b\u51fb<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>9.\u00a0\u63a8\u8350\u5de5\u5177 &amp; \u6d4b\u8bd5\u6846\u67b6<\/h4>\n<table>\n<tr>\u5de5\u5177\u540d\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>jwt.io<\/td>\n<td>\u5728\u7ebf JWT \u89e3\u7801\/\u7f16\u7801<\/td>\n<\/tr>\n<tr>\n<td>jwt_tool.py<\/td>\n<td>JWT \u7206\u7834\u3001\u4f2a\u9020\u3001\u6d4b\u8bd5\u811a\u672c\u5de5\u5177<\/td>\n<\/tr>\n<tr>\n<td>HackBar \/ Burp Suite<\/td>\n<td>\u5b9e\u6218\u4e2d\u4fee\u6539 Token \u63d0\u4ea4\u91cd\u653e<\/td>\n<\/tr>\n<tr>\n<td>Postman<\/td>\n<td>\u6a21\u62df JWT \u63a5\u53e3\u8c03\u7528<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u516d\u3001\u540c\u6e90\u7b56\u7565&#xff08;SOP&#xff09;<\/h3>\n<p>\u540c\u6e90\u7b56\u7565&#xff08;Same-Origin Policy&#xff09; \u662f\u6d4f\u89c8\u5668\u7684\u4e00\u79cd\u5b89\u5168\u673a\u5236&#xff0c;\u7528\u4e8e\u9694\u79bb\u4e0d\u540c\u7f51\u7ad9\u4e4b\u95f4\u7684\u8d44\u6e90&#xff0c;\u9632\u6b62\u6076\u610f\u7f51\u7ad9\u7a83\u53d6\u7528\u6237\u654f\u611f\u6570\u636e\u3002<\/p>\n<p>\u5b83\u6700\u521d\u662f\u4e3a\u4e86\u89e3\u51b3&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u7f51\u9875\u4e2d\u7684 JavaScript \u811a\u672c\u4e0d\u80fd\u8bbf\u95ee\u5176\u4ed6\u57df\u4e0b\u7684\u8d44\u6e90&#xff08;\u9632\u6b62 XSS\u3001CSRF&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4fdd\u62a4\u7528\u6237\u7684 Cookie\u3001\u672c\u5730\u5b58\u50a8\u3001DOM \u6570\u636e\u4e0d\u88ab\u7b2c\u4e09\u65b9\u7f51\u7ad9\u8bbf\u95ee<\/p>\n<\/li>\n<\/ul>\n<h4>1.\u00a0\u4ec0\u4e48\u53eb\u201c\u540c\u6e90\u201d&#xff1f;<\/h4>\n<p>\u8981\u5b8c\u5168\u540c\u6e90&#xff0c;\u5fc5\u987b\u6ee1\u8db3\u4e09\u4e2a\u6761\u4ef6\u5b8c\u5168\u76f8\u540c&#xff1a;<\/p>\n<table>\n<tr>\u6761\u4ef6\u8bf4\u660e\u793a\u4f8b<\/tr>\n<tbody>\n<tr>\n<td>\u534f\u8bae<\/td>\n<td>http vs https<\/td>\n<td>http:\/\/ \u2260 https:\/\/<\/td>\n<\/tr>\n<tr>\n<td>\u57df\u540d<\/td>\n<td>www.example.com vs api.example.com<\/td>\n<td>\u5b50\u57df\u540d\u4e5f\u7b97\u4e0d\u540c\u6e90<\/td>\n<\/tr>\n<tr>\n<td>\u7aef\u53e3<\/td>\n<td>80 vs 8080<\/td>\n<td>http:\/\/a.com:80 \u2260 http:\/\/a.com:8080<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u4f8b\u5982&#xff1a;<\/p>\n<p>http:\/\/a.com \u2260 https:\/\/a.com<br \/>\nhttp:\/\/a.com \u2260 http:\/\/b.com<br \/>\nhttp:\/\/a.com:80 \u2260 http:\/\/a.com:81<\/p>\n<h4>2.\u00a0SOP \u7684\u9650\u5236\u8303\u56f4&#xff08;\u9ed8\u8ba4\u7981\u6b62\u8bbf\u95ee\u7684\u5185\u5bb9&#xff09;<\/h4>\n<p>\u6d4f\u89c8\u5668\u4f1a\u5bf9\u4e0d\u540c\u6e90\u7684\u8bf7\u6c42\u6216\u8bbf\u95ee\u884c\u4e3a\u8fdb\u884c\u9650\u5236\u3002\u4ee5\u4e0b\u662f SOP \u9ed8\u8ba4\u7981\u6b62\u7684\u64cd\u4f5c&#xff1a;<\/p>\n<table>\n<tr>\u64cd\u4f5c\u662f\u5426\u5141\u8bb8<\/tr>\n<tbody>\n<tr>\n<td>JS \u8bfb\u53d6 iframe \u4e2d\u7684 DOM&#xff08;\u4e0d\u540c\u6e90&#xff09;<\/td>\n<td>\u00a0\u4e0d\u5141\u8bb8<\/td>\n<\/tr>\n<tr>\n<td>JS \u53d1\u8d77\u8de8\u57df Ajax \u8bf7\u6c42<\/td>\n<td>\u00a0\u4e0d\u5141\u8bb8<\/td>\n<\/tr>\n<tr>\n<td>JS \u8bbf\u95ee\u5176\u4ed6\u6e90\u7684 Cookie \/ localStorage<\/td>\n<td>\u00a0\u4e0d\u5141\u8bb8<\/td>\n<\/tr>\n<tr>\n<td>\u8868\u5355&#xff08;form&#xff09;\u63d0\u4ea4\u8de8\u57df<\/td>\n<td>\u00a0\u5141\u8bb8&#xff08;\u4f46\u65e0\u6cd5\u8bfb\u53d6\u54cd\u5e94&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u56fe\u7247&#xff08;img&#xff09;\u52a0\u8f7d\u8de8\u57df\u8d44\u6e90<\/td>\n<td>\u00a0\u5141\u8bb8&#xff08;\u53ea\u52a0\u8f7d&#xff0c;\u65e0\u6cd5\u64cd\u4f5c&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>3.\u00a0SOP \u7684\u6838\u5fc3\u76ee\u6807&#xff1a;\u9632\u6b62\u8de8\u7ad9\u653b\u51fb<\/h4>\n<p>\u4e3e\u4f8b&#xff1a;A \u7f51\u7ad9\u6253\u5f00 B \u7f51\u7ad9\u7684 iframe&#xff0c;\u5c1d\u8bd5\u901a\u8fc7 JS \u8bfb\u53d6\u7528\u6237\u4fe1\u606f<\/p>\n<p>\/\/ \u5047\u8bbe\u5728 a.com \u7684\u9875\u9762\u4e2d&#xff1a;<br \/>\nlet content &#061; document.getElementById(&#039;iframe&#039;).contentWindow.document;<br \/>\nconsole.log(content.cookie);  \/\/ \u62a5\u9519&#xff1a;\u540c\u6e90\u7b56\u7565\u963b\u6b62\u4e86\u8bbf\u95ee<\/p>\n<p>\u5982\u679c\u4e0d\u9650\u5236&#xff0c;\u5c31\u4f1a\u4ea7\u751f\u6781\u5927\u7684\u5b89\u5168\u9690\u60a3&#xff08;\u5982 CSRF\u3001XSS \u7b49&#xff09;\u3002<\/p>\n<h4>4.\u00a0\u5f00\u53d1\u4e2d\u9047\u5230\u7684\u5e38\u89c1\u95ee\u9898&#xff08;\u5b9e\u9645\u9650\u5236\u8868\u73b0&#xff09;<\/h4>\n<table>\n<tr>\u573a\u666f\u662f\u5426\u88ab SOP \u9650\u5236\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u4f7f\u7528 fetch \u53d1\u9001\u8de8\u57df\u8bf7\u6c42<\/td>\n<td>\u00a0\u88ab\u9650\u5236<\/td>\n<td>\u9700\u8981\u670d\u52a1\u7aef\u8bbe\u7f6e CORS \u5934<\/td>\n<\/tr>\n<tr>\n<td>JS \u8bfb\u53d6 &lt;iframe src&#061;&#034;b.com&#034;&gt; \u7684\u5185\u5bb9<\/td>\n<td>\u00a0\u88ab\u9650\u5236<\/td>\n<td>DOM \u65e0\u6cd5\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>&lt;img src&#061;&#034;2025-05-26pjak5gwkhj5.png&#034;&gt; \u52a0\u8f7d\u56fe\u7247<\/td>\n<td>\u00a0\u4e0d\u9650\u5236<\/td>\n<td>\u56fe\u7247\u52a0\u8f7d\u4e0d\u53d7\u9650\u5236<\/td>\n<\/tr>\n<tr>\n<td>&lt;script src&#061;&#034;https:\/\/cdn.com\/lib.js&#034;&gt;<\/td>\n<td>\u00a0\u4e0d\u9650\u5236<\/td>\n<td>\u53ef\u52a0\u8f7d\u7b2c\u4e09\u65b9\u811a\u672c&#xff08;\u4e5f\u662f XSS \u4f20\u64ad\u65b9\u5f0f\u4e4b\u4e00&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>5.\u00a0SOP \u7684\u7ed5\u8fc7\u65b9\u6cd5&#xff08;\u524d\u7aef\u5bf9\u7b56&#xff09;<\/h4>\n<p>\u6d4f\u89c8\u5668\u7684 SOP \u9650\u5236\u5e76\u4e0d\u662f\u7edd\u5bf9\u7684&#xff0c;\u5e38\u89c1\u7684\u7ed5\u8fc7\u65b9\u6848\u5305\u62ec&#xff1a;<\/p>\n<p>1&#xff09;CORS&#xff08;\u8de8\u57df\u8d44\u6e90\u5171\u4eab&#xff09;<\/p>\n<p>\u670d\u52a1\u7aef\u8bbe\u7f6e\u54cd\u5e94\u5934&#xff1a;<\/p>\n<p>Access-Control-Allow-Origin: https:\/\/a.com<\/p>\n<p>\u8ba9\u524d\u7aef\u5408\u6cd5\u5730\u8de8\u57df\u8bbf\u95ee\u540e\u7aef\u8d44\u6e90\u3002\u8fd9\u662f\u73b0\u4ee3\u524d\u540e\u7aef\u5206\u79bb\u7684\u6807\u51c6\u65b9\u6848\u3002<\/p>\n<p>2&#xff09;JSONP&#xff08;\u53ea\u652f\u6301 GET \u8bf7\u6c42&#xff09;<\/p>\n<p>\u901a\u8fc7 &lt;script&gt; \u6807\u7b7e\u7684\u6f0f\u6d1e\u6765\u201c\u7ed5\u8fc7\u201dSOP&#xff1a;<\/p>\n<p>&lt;script src&#061;&#034;https:\/\/api.com\/data?callback&#061;cb&#034;&gt;&lt;\/script&gt;<br \/>\n&lt;script&gt;<br \/>\nfunction cb(data) {<br \/>\n  console.log(data);<br \/>\n}<br \/>\n&lt;\/script&gt;<\/p>\n<p>JSONP \u662f\u65e9\u671f\u8de8\u57df\u7684\u65b9\u5f0f&#xff0c;\u4f46\u5b58\u5728\u5b89\u5168\u98ce\u9669&#xff0c;\u4e0d\u63a8\u8350\u65b0\u9879\u76ee\u4f7f\u7528\u3002<\/p>\n<p>3&#xff09;PostMessage&#xff08;\u5b89\u5168\u901a\u4fe1&#xff09;<\/p>\n<p>\u5141\u8bb8\u7236\u9875\u9762\u4e0e iframe \u8de8\u57df\u901a\u4fe1&#xff1a;<\/p>\n<p>\/\/ \u5b50\u9875\u9762&#xff08;b.com&#xff09;&#xff1a;<br \/>\nwindow.parent.postMessage(&#034;data&#034;, &#034;http:\/\/a.com&#034;);<\/p>\n<p>\/\/ \u7236\u9875\u9762&#xff08;a.com&#xff09;&#xff1a;<br \/>\nwindow.addEventListener(&#034;message&#034;, function(e) {<br \/>\n  if (e.origin &#061;&#061;&#061; &#034;http:\/\/b.com&#034;) {<br \/>\n    console.log(e.data);<br \/>\n  }<br \/>\n});<\/p>\n<p>\u8fd9\u662f\u73b0\u4ee3\u5b89\u5168\u901a\u4fe1\u63a8\u8350\u7684\u65b9\u5f0f\u3002<\/p>\n<p>4&#xff09;document.domain&#xff08;\u4ec5\u9650\u540c\u4e00\u4e3b\u57df&#xff09;<\/p>\n<p>\u4e24\u4e2a\u5b50\u57df\u5982 a.example.com \u548c b.example.com&#xff0c;\u53ef\u4ee5\u8bbe\u7f6e&#xff1a;<\/p>\n<p>document.domain &#061; &#034;example.com&#034;;<\/p>\n<p>\u4f7f\u5b83\u4eec\u89c6\u4e3a\u540c\u6e90&#xff0c;\u4f46\u53ea\u80fd\u5728\u4e3b\u57df\u4e00\u81f4\u65f6\u4f7f\u7528\u3002<\/p>\n<h4>6.\u00a0\u6e17\u900f\u6d4b\u8bd5\u89c6\u89d2&#xff1a;\u7ed5\u8fc7 SOP \u7684\u5229\u7528\u70b9<\/h4>\n<table>\n<tr>\u653b\u51fb\u70b9\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u7f3a\u5c11 CORS \u68c0\u67e5<\/td>\n<td>\u653b\u51fb\u8005\u53ef\u6784\u9020\u6076\u610f\u7ad9\u70b9\u53d1\u8d77\u8de8\u57df\u8bf7\u6c42<\/td>\n<\/tr>\n<tr>\n<td>CORS \u914d\u7f6e\u9519\u8bef&#xff08;\u5141\u8bb8 *&#xff09;<\/td>\n<td>Access-Control-Allow-Origin: * \u4e0e\u654f\u611f\u6570\u636e\u7ed3\u5408\u6781\u5ea6\u5371\u9669<\/td>\n<\/tr>\n<tr>\n<td>JSONP \u63a5\u53e3\u672a\u6821\u9a8c callback<\/td>\n<td>\u53ef\u88ab\u653b\u51fb\u8005\u6784\u9020\u9875\u9762\u83b7\u53d6\u7528\u6237\u6570\u636e<\/td>\n<\/tr>\n<tr>\n<td>WebSocket \u6ca1\u6709\u6765\u6e90\u6821\u9a8c<\/td>\n<td>\u653b\u51fb\u8005\u53ef\u80fd\u4f2a\u9020\u8fde\u63a5\u7a83\u53d6\u6570\u636e<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.\u00a0\u5b89\u5168\u5efa\u8bae<\/h4>\n<table>\n<tr>\u63aa\u65bd\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u5408\u7406\u914d\u7f6e CORS<\/td>\n<td>\u660e\u786e\u5141\u8bb8\u6765\u6e90&#xff0c;\u907f\u514d\u4f7f\u7528 *<\/td>\n<\/tr>\n<tr>\n<td>\u6240\u6709\u654f\u611f\u64cd\u4f5c\u8981\u6c42\u8ba4\u8bc1<\/td>\n<td>\u9632\u6b62\u88ab\u8de8\u7ad9\u8c03\u7528\u6ee5\u7528\u63a5\u53e3<\/td>\n<\/tr>\n<tr>\n<td>\u5bf9 JSONP \u63a5\u53e3\u8bbe\u7f6e\u7b7e\u540d\u9a8c\u8bc1<\/td>\n<td>\u9632\u6b62 callback \u88ab\u4efb\u610f\u6784\u9020<\/td>\n<\/tr>\n<tr>\n<td>iframe \u5185\u90e8\u7981\u6b62\u654f\u611f\u64cd\u4f5c<\/td>\n<td>\u8bbe\u7f6e X-Frame-Options \u907f\u514d\u5d4c\u5165<\/td>\n<\/tr>\n<tr>\n<td>CSP \u914d\u7f6e<\/td>\n<td>\u9650\u5236 JS \u6765\u6e90&#xff0c;\u9632\u6b62\u6076\u610f\u52a0\u8f7d\u811a\u672c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>8.\u00a0\u6d4f\u89c8\u5668 SOP \u7684\u5b9e\u73b0\u65b9\u5f0f<\/h4>\n<ul>\n<li>\n<p>\u5bf9 DOM \u5bf9\u8c61\u8fdb\u884c\u9694\u79bb&#xff08;\u6c99\u7bb1&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u8bbe\u7f6e Origin \u8bf7\u6c42\u5934\u548c Referer \u5934<\/p>\n<\/li>\n<li>\n<p>\u8de8\u57df\u8bbf\u95ee\u62a5 DOMException: Blocked a frame with origin&#8230;<\/p>\n<\/li>\n<\/ul>\n<p>\u6d4f\u89c8\u5668\u5982 Chrome\u3001Firefox \u90fd\u4e25\u683c\u9075\u5b88 SOP \u89c4\u5219\u3002<\/p>\n<h4>9.\u00a0\u5e38\u89c1\u5de5\u5177\u4e0e\u8c03\u8bd5\u6280\u5de7<\/h4>\n<table>\n<tr>\u5de5\u5177\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>Chrome DevTools<\/td>\n<td>\u67e5\u770b\u8bf7\u6c42\u7684 Origin\u3001CORS \u54cd\u5e94<\/td>\n<\/tr>\n<tr>\n<td>Burp Suite<\/td>\n<td>\u6a21\u62df\u8de8\u57df\u8bf7\u6c42\u3001CORS \u914d\u7f6e\u6d4b\u8bd5<\/td>\n<\/tr>\n<tr>\n<td>HackBar<\/td>\n<td>\u6784\u9020 JSONP \/ iframe payload<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u4e03\u3001CORS&#xff08;\u8de8\u57df\u8d44\u6e90\u5171\u4eab&#xff09;<\/h3>\n<p>CORS&#xff08;Cross-Origin Resource Sharing&#xff09;\u662f\u6d4f\u89c8\u5668\u4e3a\u4e86\u89e3\u51b3\u8de8\u57df\u8bbf\u95ee\u9650\u5236&#xff0c;\u5728\u670d\u52a1\u5668\u7aef\u901a\u8fc7\u8bbe\u7f6e HTTP \u54cd\u5e94\u5934\u6765\u544a\u8bc9\u6d4f\u89c8\u5668&#xff1a;\u201c\u54ea\u4e9b\u6e90\u53ef\u4ee5\u8bbf\u95ee\u6211\u201d\u3002<\/p>\n<p>\u5b83\u662f\u540c\u6e90\u7b56\u7565&#xff08;SOP&#xff09;\u9650\u5236\u7684\u6807\u51c6\u5316\u6269\u5c55\u673a\u5236&#xff0c;\u5141\u8bb8\u5ba2\u6237\u7aef\u4ece\u4e0d\u540c\u6e90\u7684\u670d\u52a1\u5668\u8bf7\u6c42\u8d44\u6e90\u3002<\/p>\n<h4>1.\u00a0\u4ec0\u4e48\u662f\u8de8\u57df&#xff1f;<\/h4>\n<p>\u8de8\u57df\u7684\u672c\u8d28\u662f\u6e90\u4e0d\u540c&#xff08;origin&#xff09;\u3002\u5224\u65ad\u662f\u5426\u8de8\u57df&#xff0c;\u8981\u6bd4\u8f83&#xff1a;<\/p>\n<table>\n<tr>\u534f\u8bae\u57df\u540d\u7aef\u53e3<\/tr>\n<tbody>\n<tr>\n<td>http:\/\/a.com<\/td>\n<td>vs<\/td>\n<td>https:\/\/a.com<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/a.com<\/td>\n<td>vs<\/td>\n<td>http:\/\/b.com<\/td>\n<\/tr>\n<tr>\n<td>http:\/\/a.com:80<\/td>\n<td>vs<\/td>\n<td>http:\/\/a.com:81<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u53ea\u8981\u4e09\u8005\u6709\u4e00\u4e2a\u4e0d\u540c&#xff0c;\u5c31\u53eb\u505a\u201c\u8de8\u57df\u8bf7\u6c42\u201d\u3002<\/p>\n<h4>2.\u00a0CORS \u7684\u57fa\u672c\u6d41\u7a0b&#xff08;\u4ee5\u6d4f\u89c8\u5668\u4e3a\u4f8b&#xff09;<\/h4>\n<p>\u5f53\u524d\u7aef\u5411\u8de8\u57df\u540e\u7aef\u53d1\u8bf7\u6c42\u65f6&#xff0c;\u6d4f\u89c8\u5668\u4f1a\u68c0\u67e5\u662f\u5426\u5141\u8bb8&#xff0c;\u5982\u679c\u5141\u8bb8\u5219\u7ee7\u7eed&#xff0c;\u5426\u5219\u963b\u6b62\u8bbf\u95ee\u3002<\/p>\n<p>1&#xff09;\u7b80\u5355\u8bf7\u6c42&#xff08;simple request&#xff09;<\/p>\n<p>\u6ee1\u8db3\u4ee5\u4e0b\u6761\u4ef6\u7684\u8bf7\u6c42&#xff0c;\u79f0\u4e3a\u7b80\u5355\u8bf7\u6c42&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u4f7f\u7528\u65b9\u6cd5&#xff1a;GET\u3001HEAD\u3001POST<\/p>\n<\/li>\n<li>\n<p>Content-Type \u9650\u5236\u4e3a&#xff1a;<\/p>\n<ul>\n<li>\n<p>application\/x-www-form-urlencoded<\/p>\n<\/li>\n<li>\n<p>multipart\/form-data<\/p>\n<\/li>\n<li>\n<p>text\/plain<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u8bf7\u6c42\u5934\u6ca1\u6709\u81ea\u5b9a\u4e49&#xff08;\u6bd4\u5982\u6ca1\u6709\u5e26 token&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>\u6d4f\u89c8\u5668\u76f4\u63a5\u53d1\u8bf7\u6c42&#xff0c;\u540e\u7aef\u8fd4\u56de\u54cd\u5e94&#xff1a;<\/p>\n<p>\u8bf7\u6c42&#xff1a;<\/p>\n<p>GET \/api\/data HTTP\/1.1<br \/>\nOrigin: http:\/\/a.com<\/p>\n<p>\u54cd\u5e94&#xff1a;<\/p>\n<p>Access-Control-Allow-Origin: http:\/\/a.com<\/p>\n<p>\u5982\u679c\u8fd9\u4e2a\u5934\u90e8\u4e0d\u5b58\u5728&#xff0c;\u6d4f\u89c8\u5668\u5c31\u4f1a\u62e6\u622a\u54cd\u5e94\u7ed3\u679c&#xff08;\u867d\u7136\u8bf7\u6c42\u6210\u529f&#xff0c;\u4f46\u65e0\u6cd5\u8bbf\u95ee\u54cd\u5e94\u6570\u636e&#xff09;\u3002<\/p>\n<p>2&#xff09;\u975e\u7b80\u5355\u8bf7\u6c42&#xff08;Preflight \u9884\u68c0\u8bf7\u6c42&#xff09;<\/p>\n<p>\u5982\u679c\u4f7f\u7528\u4e86&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u65b9\u6cd5\u4e3a PUT\u3001DELETE\u3001PATCH \u7b49<\/p>\n<\/li>\n<li>\n<p>\u8bf7\u6c42\u5934\u5e26\u6709\u81ea\u5b9a\u4e49\u5b57\u6bb5&#xff08;\u5982 Authorization, X-Custom-Header&#xff09;<\/p>\n<\/li>\n<li>\n<p>Content-Type \u975e\u7b80\u5355\u7c7b\u578b&#xff08;\u5982 application\/json&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>\u6d4f\u89c8\u5668\u4f1a\u5148\u81ea\u52a8\u53d1\u9001\u4e00\u4e2a \u9884\u68c0\u8bf7\u6c42&#xff08;OPTIONS&#xff09;&#xff0c;\u786e\u8ba4\u670d\u52a1\u7aef\u662f\u5426\u5141\u8bb8\u8de8\u57df\u3002<\/p>\n<p>\u9884\u68c0\u8bf7\u6c42&#xff08;OPTIONS&#xff09;&#xff1a;<\/p>\n<p>OPTIONS \/api\/update HTTP\/1.1<br \/>\nOrigin: http:\/\/a.com<br \/>\nAccess-Control-Request-Method: PUT<br \/>\nAccess-Control-Request-Headers: Content-Type<\/p>\n<p>\u54cd\u5e94&#xff1a;<\/p>\n<p>Access-Control-Allow-Origin: http:\/\/a.com<br \/>\nAccess-Control-Allow-Methods: PUT, POST, GET<br \/>\nAccess-Control-Allow-Headers: Content-Type<\/p>\n<p>\u9884\u68c0\u901a\u8fc7\u540e&#xff0c;\u6d4f\u89c8\u5668\u624d\u4f1a\u53d1\u8d77\u771f\u6b63\u7684\u8de8\u57df\u8bf7\u6c42\u3002<\/p>\n<h4>3.\u00a0\u5e38\u89c1\u54cd\u5e94\u5934\u5b57\u6bb5\u8be6\u89e3&#xff08;\u7531\u670d\u52a1\u5668\u8bbe\u7f6e&#xff09;<\/h4>\n<table>\n<tr>\u54cd\u5e94\u5934\u542b\u4e49<\/tr>\n<tbody>\n<tr>\n<td>Access-Control-Allow-Origin<\/td>\n<td>\u6307\u5b9a\u5141\u8bb8\u8bbf\u95ee\u8d44\u6e90\u7684\u57df\u540d&#xff08;\u5982 http:\/\/a.com&#xff09;\u6216 *<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Allow-Methods<\/td>\n<td>\u5141\u8bb8\u7684 HTTP \u65b9\u6cd5&#xff08;\u5982 GET, POST, PUT&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Allow-Headers<\/td>\n<td>\u5141\u8bb8\u7684\u81ea\u5b9a\u4e49\u8bf7\u6c42\u5934<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Allow-Credentials<\/td>\n<td>\u662f\u5426\u5141\u8bb8\u643a\u5e26 Cookie&#xff0c;\u5fc5\u987b\u4e3a true<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Expose-Headers<\/td>\n<td>\u5141\u8bb8\u524d\u7aef JS \u8bbf\u95ee\u7684\u54cd\u5e94\u5934&#xff08;\u9ed8\u8ba4 JS \u53ea\u80fd\u8bfb\u90e8\u5206 header&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Max-Age<\/td>\n<td>\u9884\u68c0\u8bf7\u6c42\u7684\u7f13\u5b58\u65f6\u95f4&#xff0c;\u5355\u4f4d\u79d2&#xff08;\u51cf\u5c11\u91cd\u590d\u9884\u68c0&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u793a\u4f8b\u54cd\u5e94\u5934&#xff08;\u914d\u7f6e\u793a\u4f8b&#xff09;&#xff1a;<\/p>\n<p>Access-Control-Allow-Origin: https:\/\/a.com<br \/>\nAccess-Control-Allow-Credentials: true<br \/>\nAccess-Control-Allow-Methods: GET, POST, PUT<br \/>\nAccess-Control-Allow-Headers: Content-Type, Authorization<br \/>\nAccess-Control-Max-Age: 3600<\/p>\n<h4>4.\u00a0CORS \u5b89\u5168\u98ce\u9669\u4e0e\u653b\u51fb\u5229\u7528<\/h4>\n<p>\u867d\u7136 CORS \u662f\u4e3a\u4e86\u5b89\u5168\u800c\u8bbe\u8ba1\u7684&#xff0c;\u4f46\u914d\u7f6e\u4e0d\u5f53\u53cd\u800c\u4f1a\u6210\u4e3a\u6f0f\u6d1e\u5165\u53e3&#xff0c;\u653b\u51fb\u8005\u53ef\u4ee5\u501f\u6b64\u53d1\u8d77\u653b\u51fb&#xff1a;<\/p>\n<p>1&#xff09;Access-Control-Allow-Origin: *<\/p>\n<p>\u5982\u679c\u670d\u52a1\u7aef\u8bbe\u7f6e\u4e86&#xff1a;<\/p>\n<p>Access-Control-Allow-Origin: *<\/p>\n<p>\u4e14\u63a5\u53e3\u8fd8\u8fd4\u56de\u4e86\u654f\u611f\u4fe1\u606f\u6216\u7528\u6237\u9690\u79c1\u6570\u636e&#xff08;\u5982\u767b\u5f55\u6001\u3001\u8ba2\u5355\u3001\u94f6\u884c\u5361&#xff09;&#xff0c;\u5c31\u5141\u8bb8\u4efb\u610f\u7f51\u7ad9\u8de8\u57df\u8bfb\u53d6\u7528\u6237\u6570\u636e&#xff0c;\u8fd9\u662f\u4e25\u91cd\u6f0f\u6d1e&#xff01;<\/p>\n<p>\u5c24\u5176\u5371\u9669\u5f53\u8fd8\u8bbe\u7f6e\u4e86 Access-Control-Allow-Credentials: true&#xff01;<\/p>\n<p>2&#xff09;\u53cd\u5c04\u578b Origin \u6821\u9a8c\u7ed5\u8fc7<\/p>\n<p>\u6709\u4e9b\u670d\u52a1\u7aef\u5199\u6cd5\u662f&#xff1a;<\/p>\n<p>res.setHeader(&#034;Access-Control-Allow-Origin&#034;, req.headers.origin);<\/p>\n<p>\u8fd9\u4f1a\u5bfc\u81f4\u4efb\u610f Origin \u90fd\u80fd\u88ab\u670d\u52a1\u7aef\u53cd\u5c04&#xff0c;\u5982\u679c\u6ca1\u6709\u505a\u767d\u540d\u5355\u6821\u9a8c&#xff0c;\u975e\u5e38\u5371\u9669&#xff01;<\/p>\n<p>3&#xff09;\u670d\u52a1\u7aef\u914d\u7f6e\u9519\u8bef\u5bfc\u81f4\u653b\u51fb\u8005\u7f51\u7ad9\u53ef\u4ee5\u53d1\u8bf7\u6c42\u8bfb\u53d6\u6570\u636e<\/p>\n<p>\u653b\u51fb\u8005\u53ea\u9700\u4f2a\u9020\u9875\u9762&#xff0c;\u5728 victim \u7528\u6237\u6253\u5f00\u540e\u5373\u53ef\u8bfb\u53d6\u5176\u5728\u771f\u5b9e\u7f51\u7ad9\u4e2d\u7684\u6570\u636e&#xff1a;<\/p>\n<p>fetch(&#034;https:\/\/bank.com\/api\/user&#034;, {<br \/>\n  credentials: &#039;include&#039;<br \/>\n})<br \/>\n.then(res &#061;&gt; res.json())<br \/>\n.then(data &#061;&gt; {<br \/>\n  \/\/ \u653b\u51fb\u8005\u8bfb\u53d6\u7528\u6237\u6570\u636e<br \/>\n  sendToMe(data);<br \/>\n});<\/p>\n<h4>5.\u00a0\u6e17\u900f\u6d4b\u8bd5\u4e2d\u5982\u4f55\u68c0\u6d4b CORS \u95ee\u9898&#xff1f;<\/h4>\n<p>\u5e38\u7528\u65b9\u6cd5&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u7528 Burp Suite \u4fee\u6539 Origin \u5934&#xff0c;\u6d4b\u8bd5\u662f\u5426\u88ab\u5141\u8bb8<\/p>\n<\/li>\n<li>\n<p>\u4fee\u6539 Access-Control-Allow-Credentials \u4e3a true&#xff0c;\u89c2\u5bdf\u54cd\u5e94\u5934\u662f\u5426\u653e\u5f00<\/p>\n<\/li>\n<li>\n<p>\u7528 curl \u6216 Postman \u6784\u9020 OPTIONS \u8bf7\u6c42&#xff0c;\u67e5\u770b\u670d\u52a1\u5668\u662f\u5426\u54cd\u5e94\u9884\u68c0<\/p>\n<\/li>\n<\/ul>\n<h4>6.\u00a0\u5b89\u5168\u914d\u7f6e\u5efa\u8bae<\/h4>\n<table>\n<tr>\u9879\u76ee\u5efa\u8bae\u914d\u7f6e<\/tr>\n<tbody>\n<tr>\n<td>Access-Control-Allow-Origin<\/td>\n<td>\u53ea\u5141\u8bb8\u660e\u786e\u7684\u767d\u540d\u5355\u57df\u540d<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Allow-Credentials<\/td>\n<td>\u4ec5\u5728\u786e\u5b9e\u9700\u8981\u65f6\u8bbe\u7f6e\u4e3a true&#xff0c;\u5e76\u4e0d\u80fd\u4e0e * \u540c\u65f6\u4f7f\u7528<\/td>\n<\/tr>\n<tr>\n<td>Access-Control-Allow-Headers<\/td>\n<td>\u63a7\u5236\u5141\u8bb8\u7684\u81ea\u5b9a\u4e49\u5934&#xff0c;\u907f\u514d\u8fc7\u5bbd<\/td>\n<\/tr>\n<tr>\n<td>\u68c0\u67e5 Origin \u767d\u540d\u5355<\/td>\n<td>\u4e0d\u8981\u7b80\u5355\u53cd\u5c04\u8bf7\u6c42\u5934&#xff0c;\u8981\u4e25\u683c\u6821\u9a8c\u5408\u6cd5\u57df\u540d<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.\u00a0\u5e38\u7528\u8c03\u8bd5\u5de5\u5177<\/h4>\n<table>\n<tr>\u5de5\u5177\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>Chrome DevTools &#8211; Network<\/td>\n<td>\u67e5\u770b\u8bf7\u6c42\u662f\u5426\u88ab CORS \u62e6\u622a<\/td>\n<\/tr>\n<tr>\n<td>curl<\/td>\n<td>\u6784\u9020\u8de8\u57df\u548c\u9884\u68c0\u8bf7\u6c42<\/td>\n<\/tr>\n<tr>\n<td>Postman<\/td>\n<td>\u6a21\u62df\u8bf7\u6c42&#xff08;\u6ce8\u610f Postman \u4e0d\u53d7 SOP \u9650\u5236&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>Burp Suite<\/td>\n<td>\u52ab\u6301 Origin \u5934&#xff0c;\u6d4b\u8bd5\u670d\u52a1\u7aef\u914d\u7f6e<\/td>\n<\/tr>\n<tr>\n<td>CORS Everywhere \u63d2\u4ef6<\/td>\n<td>\u6d4b\u8bd5\u8de8\u57df\u8c03\u8bd5&#xff08;\u4ec5\u5f00\u53d1\u7528&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u516b\u3001URL \u7f16\u7801<\/h3>\n<p>URL \u7f16\u7801&#xff0c;\u53c8\u53eb \u767e\u5206\u53f7\u7f16\u7801&#xff08;Percent Encoding&#xff09;&#xff0c;\u662f\u4e3a\u4e86\u5c06 URL \u4e2d\u4e0d\u5141\u8bb8\u51fa\u73b0\u7684\u7279\u6b8a\u5b57\u7b26 \u8f6c\u6362\u4e3a\u5408\u6cd5\u683c\u5f0f&#xff0c;\u4fbf\u4e8e\u5b89\u5168\u4f20\u8f93\u3002<\/p>\n<p>URL \u53ea\u80fd\u4f7f\u7528 ASCII \u5b57\u7b26\u96c6&#xff0c;\u4e0d\u80fd\u76f4\u63a5\u5305\u542b&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u7a7a\u683c&#xff08; &#xff09;<\/p>\n<\/li>\n<li>\n<p>\u4e2d\u6587&#xff08;\u5982 \u4f60\u597d&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u7279\u6b8a\u7b26\u53f7&#xff08;\u5982 #\u3001&amp;\u3001?\u3001&#061;, \/ \u7b49&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>\u6240\u4ee5\u9700\u8981\u5c06\u8fd9\u4e9b\u5b57\u7b26\u8fdb\u884c\u7f16\u7801&#xff0c;\u624d\u80fd\u6b63\u786e\u4f20\u9012\u7ed9\u670d\u52a1\u5668\u3002<\/p>\n<h4>1.\u00a0URL \u7f16\u7801\u7684\u539f\u7406<\/h4>\n<p>\u683c\u5f0f\u4e3a&#xff1a;<\/p>\n<p>% &#043; \u4e24\u4f4d\u5341\u516d\u8fdb\u5236\u8868\u793a\u7684 ASCII \u7801<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<table>\n<tr>\u5b57\u7b26ASCIIURL \u7f16\u7801<\/tr>\n<tbody>\n<tr>\n<td>\u7a7a\u683c<\/td>\n<td>0x20<\/td>\n<td>%20&#xff08;\u6216 &#043;&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>&#043;<\/td>\n<td>0x2B<\/td>\n<td>%2B<\/td>\n<\/tr>\n<tr>\n<td>\/<\/td>\n<td>0x2F<\/td>\n<td>%2F<\/td>\n<\/tr>\n<tr>\n<td>?<\/td>\n<td>0x3F<\/td>\n<td>%3F<\/td>\n<\/tr>\n<tr>\n<td>&#061;<\/td>\n<td>0x3D<\/td>\n<td>%3D<\/td>\n<\/tr>\n<tr>\n<td>&amp;<\/td>\n<td>0x26<\/td>\n<td>%26<\/td>\n<\/tr>\n<tr>\n<td>#<\/td>\n<td>0x23<\/td>\n<td>%23<\/td>\n<\/tr>\n<tr>\n<td>\u4e2d\u6587 \u201c\u4f60\u201d<\/td>\n<td>U&#043;4F60<\/td>\n<td>%E4%BD%A0&#xff08;UTF-8 \u7f16\u7801\u540e\u518d\u8f6c\u4e3a\u5341\u516d\u8fdb\u5236&#xff09;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2. \u54ea\u4e9b\u5b57\u7b26\u9700\u8981\u88ab\u7f16\u7801&#xff1f;<\/h4>\n<table>\n<tr>\u7c7b\u578b\u662f\u5426\u9700\u8981\u7f16\u7801<\/tr>\n<tbody>\n<tr>\n<td>\u82f1\u6587\u5b57\u6bcd A\u2013Z\u3001a\u2013z<\/td>\n<td>\u00a0\u4e0d\u9700\u8981<\/td>\n<\/tr>\n<tr>\n<td>\u6570\u5b57 0\u20139<\/td>\n<td>\u00a0\u4e0d\u9700\u8981<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u5b57\u7b26 &#8211; _ . ~<\/td>\n<td>\u00a0\u4e0d\u9700\u8981<\/td>\n<\/tr>\n<tr>\n<td>\u7a7a\u683c<\/td>\n<td>\u00a0\u9700\u7f16\u7801\u4e3a %20 \u6216 &#043;&#xff08;\u5728 application\/x-www-form-urlencoded \u4e2d&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u5176\u5b83\u5b57\u7b26\u5982 : \/ ? # &amp; &#061; %<\/td>\n<td>\u00a0\u5fc5\u987b\u7f16\u7801<\/td>\n<\/tr>\n<tr>\n<td>\u975e ASCII \u5b57\u7b26&#xff08;\u5982\u4e2d\u6587&#xff09;<\/td>\n<td>\u00a0\u5fc5\u987b\u7f16\u7801<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>3.\u00a0URL \u7f16\u7801\u7684\u4f7f\u7528\u4f4d\u7f6e<\/h4>\n<p>1&#xff09;\u6d4f\u89c8\u5668\u5730\u5740\u680f\u4e2d\u7684\u53c2\u6570&#xff1a;<\/p>\n<p>GET \/search?q&#061;%E5%BC%A0%E4%B8%89 HTTP\/1.1<\/p>\n<p>2&#xff09;\u8868\u5355\u63d0\u4ea4\u65f6&#xff1a;<\/p>\n<p>\u8868\u5355 Content-Type: application\/x-www-form-urlencoded \u65f6&#xff0c;\u8868\u5355\u5b57\u6bb5\u4f1a\u88ab URL \u7f16\u7801<\/p>\n<p>3&#xff09;AJAX\u3001Fetch \u8bf7\u6c42\u4e2d\u53c2\u6570\u62fc\u63a5<\/p>\n<p>4&#xff09;\u7f16\u7801\u654f\u611f\u5b57\u7b26\u4ee5\u9632\u6b62\u53c2\u6570\u6c61\u67d3\u3001\u89e3\u6790\u9519\u8bef<\/p>\n<h4>4.\u00a0Web \u5b89\u5168\u4e2d\u7684 URL \u7f16\u7801&#xff08;\u7ed5\u8fc7\u6280\u5de7&#xff09;<\/h4>\n<p>1&#xff09;\u53c2\u6570\u6df7\u6dc6\u7ed5\u8fc7\u9632\u706b\u5899&#xff08;WAF&#xff09;&#xff1a;<\/p>\n<p>\u5047\u5982 WAF \u62e6\u622a ..\/..\/etc\/passwd&#xff0c;\u4f60\u53ef\u80fd\u8bd5\u8bd5&#xff1a;<\/p>\n<ul>\n<li>\n<p>%2e%2e%2f%2e%2e%2fetc%2fpasswd<\/p>\n<\/li>\n<li>\n<p>%252e%252e%252f&#xff08;\u53cc\u91cd\u7f16\u7801\u7ed5\u8fc7&#xff09;<\/p>\n<\/li>\n<li>\n<p>%c0%ae%c0%ae%c0%af<\/p>\n<\/li>\n<\/ul>\n<p>2&#xff09;XSS \u5229\u7528\u4e2d&#xff1a;<\/p>\n<p>&lt;script&gt;alert(1)&lt;\/script&gt;<\/p>\n<p>\u7f16\u7801\u540e\u53d8\u4e3a&#xff1a;<\/p>\n<p>%3Cscript%3Ealert(1)%3C%2Fscript%3E<\/p>\n<p>WAF \u53ef\u80fd\u6ca1\u80fd\u8bc6\u522b\u6240\u6709\u7f16\u7801\u5f62\u5f0f&#xff0c;\u4ece\u800c\u5b9e\u73b0\u7ed5\u8fc7\u3002<\/p>\n<p>3&#xff09;SQL \u6ce8\u5165\u6df7\u6dc6&#xff1a;<\/p>\n<p>?id&#061;1%20OR%201&#061;1<\/p>\n<p>\u7f16\u7801\u4e86\u7a7a\u683c&#xff0c;\u9632\u6b62\u88ab\u62e6\u622a\u3002<\/p>\n<h4>5.\u00a0\u7f16\u7801\/\u89e3\u7801\u5de5\u5177<\/h4>\n<p>1&#xff09;Python \u4ee3\u7801\u6f14\u793a&#xff1a;<\/p>\n<p>from urllib.parse import quote, unquote<\/p>\n<p># \u7f16\u7801\u4e2d\u6587<br \/>\ns &#061; &#034;\u4f60\u597d world!&#034;<br \/>\nencoded &#061; quote(s)  # %E4%BD%A0%E5%A5%BD%20world%21<br \/>\nprint(encoded)<\/p>\n<p># \u89e3\u7801<br \/>\nprint(unquote(encoded))  # \u4f60\u597d world!<\/p>\n<p>2&#xff09;Burp Suite \u89e3\u7801\u5de5\u5177&#xff1a;<\/p>\n<p>\u5728 Repeater\/Decoder \u6807\u7b7e\u9875\u53ef\u4ee5\u5feb\u901f Base64\u3001URL\u3001HTML\u3001Unicode \u7f16\u89e3\u7801<\/p>\n<p>3&#xff09;Chrome \u63a7\u5236\u53f0&#xff1a;<\/p>\n<p>encodeURIComponent(&#034;\u4f60\u597d&amp;&#061;123&#034;)<br \/>\n\/\/ \u8f93\u51fa&#xff1a;&#034;%E4%BD%A0%E5%A5%BD%26%3D123&#034;<\/p>\n<h4>6.\u00a0\u5e38\u89c1\u7f16\u7801\u9677\u9631\u4e0e\u9519\u8bef<\/h4>\n<table>\n<tr>\u95ee\u9898\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u91cd\u590d\u7f16\u7801<\/td>\n<td>\u5982 %252e \u662f %2e \u7684\u518d\u7f16\u7801&#xff08;\u53cc\u91cd\u7f16\u7801&#xff09;&#xff0c;\u670d\u52a1\u5668\u53ef\u80fd\u89e3\u7801\u4e24\u6b21<\/td>\n<\/tr>\n<tr>\n<td>\u7f16\u7801\u4f4d\u7f6e\u9519\u8bef<\/td>\n<td>\u7f16\u7801\u503c\u9519\u653e\u5728 URL path \u6216 query \u4e2d&#xff0c;\u53ef\u80fd\u5bfc\u81f4\u8def\u5f84\u89e3\u6790\u9519\u8bef<\/td>\n<\/tr>\n<tr>\n<td>\u7f16\u7801\u4e0d\u4e00\u81f4<\/td>\n<td>\u524d\u7aef\u7528 encodeURIComponent&#xff0c;\u540e\u7aef\u6ca1\u5bf9\u5e94\u89e3\u7801&#xff0c;\u4f1a\u5bfc\u81f4\u53c2\u6570\u4e22\u5931<\/td>\n<\/tr>\n<tr>\n<td>\u7f16\u7801\u7ed5\u8fc7\u9632\u5fa1<\/td>\n<td>\u9632\u5fa1\u673a\u5236\u53ea\u68c0\u67e5\u539f\u59cb\u5b57\u7b26\u4e32&#xff0c;\u672a\u89e3\u7801\u5904\u7406&#xff0c;\u6613\u88ab\u7ed5\u8fc7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>7.\u00a0\u4e0e\u5176\u4ed6\u7f16\u7801\u65b9\u5f0f\u5bf9\u6bd4<\/h4>\n<table>\n<tr>\u7f16\u7801\u65b9\u5f0f\u7528\u9014\u662f\u5426\u5b89\u5168<\/tr>\n<tbody>\n<tr>\n<td>URL \u7f16\u7801<\/td>\n<td>\u6d4f\u89c8\u5668\u4f20\u53c2\u3001Form \u8868\u5355<\/td>\n<td>\u00a0\u662f\u00a0 \u00a0 \u00a0 \u9632\u6b62\u683c\u5f0f\u9519\u4e71&#xff0c;\u4f46\u975e\u52a0\u5bc6<\/td>\n<\/tr>\n<tr>\n<td>Base64 \u7f16\u7801<\/td>\n<td>\u6570\u636e\u4f20\u8f93&#xff08;\u5982\u56fe\u7247\u3001JWT&#xff09;<\/td>\n<td>\u00a0\u5426\u00a0 \u00a0 \u00a0 \u4ec5\u7f16\u7801&#xff0c;\u975e\u52a0\u5bc6<\/td>\n<\/tr>\n<tr>\n<td>HTML \u5b9e\u4f53\u7f16\u7801<\/td>\n<td>\u9632\u6b62 XSS \u6ce8\u5165<\/td>\n<td>\u00a0\u662f\u00a0 \u00a0 \u00a0 \u5982 &lt; \u7f16\u7801\u4e3a &amp;lt;<\/td>\n<\/tr>\n<tr>\n<td>JavaScript \u8f6c\u4e49<\/td>\n<td>\u9632\u6b62 XSS&#xff0c;\u7ed5\u8fc7 JS \u89e3\u6790<\/td>\n<td>\u00a0\u662f\u00a0 \\\\x3C \u662f &lt;<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u9879\u76ee\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u7f16\u7801\u89c4\u5219<\/td>\n<td>% &#043; \u4e24\u4f4d\u5341\u516d\u8fdb\u5236 ASCII<\/td>\n<\/tr>\n<tr>\n<td>\u7a7a\u683c<\/td>\n<td>%20 \u6216 &#043;&#xff08;\u8868\u5355&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u4e2d\u6587<\/td>\n<td>UTF-8 \u2192 hex \u2192 %XX \u683c\u5f0f<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u7528\u9014<\/td>\n<td>\u9632\u6b62\u53c2\u6570\u9519\u4e71\u3001WAF \u7ed5\u8fc7\u3001XSS \u6df7\u6dc6<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u98ce\u9669<\/td>\n<td>\u53cc\u91cd\u7f16\u7801\u7ed5\u8fc7\u3001\u89e3\u7801\u4e0d\u4e00\u81f4\u95ee\u9898<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u4e5d\u3001Base64 \u7f16\u7801<\/h3>\n<p>Base64 \u662f\u4e00\u79cd\u5c06 \u4efb\u610f\u4e8c\u8fdb\u5236\u6570\u636e \u7f16\u7801\u6210 \u53ef\u6253\u5370 ASCII \u5b57\u7b26 \u7684\u65b9\u5f0f&#xff0c;\u5e38\u7528\u4e8e&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u6570\u636e\u4f20\u8f93&#xff08;\u5982 JSON\u3001\u8868\u5355\u3001URL \u4e2d&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u6570\u636e\u5b58\u50a8&#xff08;\u5982\u56fe\u7247\u3001\u8bc1\u4e66&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u907f\u514d\u5b57\u7b26\u5728\u4f20\u8f93\u4e2d\u51fa\u9519\u6216\u88ab\u89e3\u6790<\/p>\n<\/li>\n<\/ul>\n<p>\u91cd\u70b9&#xff1a;Base64 \u4e0d\u662f\u52a0\u5bc6&#xff0c;\u4e5f\u4e0d\u662f\u538b\u7f29&#xff0c;\u4ec5\u662f\u7f16\u7801&#xff01;<\/p>\n<h4>1.\u00a0Base64 \u7f16\u7801\u539f\u7406\u8be6\u89e3<\/h4>\n<p>\u539f\u7406\u6982\u62ec&#xff1a;<\/p>\n<p>\u5c06\u539f\u59cb\u6570\u636e\u6bcf 3 \u5b57\u8282&#xff08;3 x 8 &#061; 24 bit&#xff09; \u4e00\u7ec4&#xff0c;\u62c6\u5206\u4e3a 4 \u4e2a 6 \u4f4d\u4e8c\u8fdb\u5236\u6570&#xff08;4 x 6 &#061; 24 bit&#xff09;&#xff0c;\u518d\u6620\u5c04\u5230\u4e00\u4e2a Base64 \u5b57\u7b26\u8868\u4e2d\u3002<\/p>\n<p>Base64 \u5b57\u7b26\u8868&#xff1a;<\/p>\n<p>A-Z a-z 0-9 &#043; \/<br \/>\n\u5171 64 \u4e2a\u5b57\u7b26<\/p>\n<table>\n<tr>\u7f16\u7801\u503c\u5b57\u7b26\u8303\u56f4<\/tr>\n<tbody>\n<tr>\n<td>0-25<\/td>\n<td>A-Z<\/td>\n<\/tr>\n<tr>\n<td>26-51<\/td>\n<td>a-z<\/td>\n<\/tr>\n<tr>\n<td>52-61<\/td>\n<td>0-9<\/td>\n<\/tr>\n<tr>\n<td>62<\/td>\n<td>&#043;<\/td>\n<\/tr>\n<tr>\n<td>63<\/td>\n<td>\/<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u586b\u5145\u7b26 &#061;&#xff1a; \u5f53\u539f\u59cb\u6570\u636e\u4e0d\u662f 3 \u5b57\u8282\u6574\u6570\u500d\u65f6&#xff0c;\u4f1a\u7528 &#061; \u8fdb\u884c\u8865\u9f50&#xff0c;1 \u4e2a\u6216 2 \u4e2a &#061;\u3002<\/p>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>\u7f16\u7801\u539f\u59cb\u5b57\u7b26\u4e32&#xff1a;abc<\/p>\n<p>1&#xff09;\u5c06\u6bcf\u4e2a\u5b57\u7b26\u8f6c\u6362\u4e3a ASCII&#xff08;\u4e8c\u8fdb\u5236&#xff09;<\/p>\n<p>a: 01100001<br \/>\nb: 01100010<br \/>\nc: 01100011<br \/>\n\u2192 \u62fc\u63a5&#xff1a;011000010110001001100011<\/p>\n<p>2&#xff09;\u6309 6 \u4f4d\u62c6\u5206\u4e3a&#xff1a;<\/p>\n<p>011000 010110 001001 100011<br \/>\n\u5341\u8fdb\u5236&#xff1a;24 22 9 35<br \/>\n\u6620\u5c04&#xff1a; Y W J j<\/p>\n<p>\u7ed3\u679c&#xff1a;YWJj<\/p>\n<p>Python \u6f14\u793a&#xff1a;<\/p>\n<p>import base64<\/p>\n<p># \u7f16\u7801<br \/>\ntext &#061; &#034;abc&#034;<br \/>\nencoded &#061; base64.b64encode(text.encode())  # b&#039;YWJj&#039;<br \/>\nprint(encoded.decode())<\/p>\n<p># \u89e3\u7801<br \/>\ndecoded &#061; base64.b64decode(encoded).decode()<br \/>\nprint(decoded)<\/p>\n<h4>2.\u00a0Base64 \u7684\u4f7f\u7528\u573a\u666f<\/h4>\n<table>\n<tr>\u573a\u666f\u793a\u4f8b<\/tr>\n<tbody>\n<tr>\n<td>JWT<\/td>\n<td>header.payload.signature \u4e2d\u7684 header \u548c payload \u662f base64url \u7f16\u7801<\/td>\n<\/tr>\n<tr>\n<td>\u56fe\u7247<\/td>\n<td>&lt;img src&#061;&#034;data:image\/png;base64,XXX&#034;&gt;<\/td>\n<\/tr>\n<tr>\n<td>\u6587\u4ef6\u4e0a\u4f20<\/td>\n<td>\u6587\u4ef6\u5185\u5bb9\u8f6c\u4e3a base64 \u53d1\u9001\u5230\u670d\u52a1\u5668<\/td>\n<\/tr>\n<tr>\n<td>HTTP Basic Auth<\/td>\n<td>Authorization: Basic dXNlcjpwYXNz&#xff08;user:pass \u7684 base64&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>URL \u53c2\u6570<\/td>\n<td>\u6570\u636e\u8f6c\u4e3a base64 \u518d\u653e\u5230 URL \u4e2d\u4f20\u8f93<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>3.\u00a0Base64 \u548c Base64URL \u7684\u533a\u522b<\/h4>\n<table>\n<tr>\u6bd4\u8f83\u9879Base64Base64URL&#xff08;\u5b89\u5168\u7248\u672c&#xff09;<\/tr>\n<tbody>\n<tr>\n<td>&#043; \u66ff\u6362\u4e3a<\/td>\n<td>&#043;<\/td>\n<td>&#8211;<\/td>\n<\/tr>\n<tr>\n<td>\/ \u66ff\u6362\u4e3a<\/td>\n<td>\/<\/td>\n<td>_<\/td>\n<\/tr>\n<tr>\n<td>\u672b\u5c3e &#061;<\/td>\n<td>\u6709<\/td>\n<td>\u53ef\u7701\u7565<\/td>\n<\/tr>\n<tr>\n<td>\u7528\u4e8e<\/td>\n<td>\u5e38\u89c4\u573a\u666f<\/td>\n<td>JWT\u3001URL\u3001Web \u5b89\u5168\u76f8\u5173\u4f20\u8f93<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>Base64:     abc123! \u2192 YWJjMTIzIQ&#061;&#061;<br \/>\nBase64URL:            YWJjMTIzIQ      # \u53bb\u6389\u4e86\u7b49\u53f7<\/p>\n<h4>4.\u00a0Base64 \u4e0e Web \u5b89\u5168\u7684\u5173\u7cfb<\/h4>\n<p>\u5e94\u7528&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u53c2\u6570\u4f20\u8f93\u9690\u85cf \u628a JSON \u53c2\u6570 base64 \u7f16\u7801&#xff0c;\u907f\u514d\u524d\u7aef\u76f4\u63a5\u66b4\u9732\u7ed3\u6784<\/p>\n<\/li>\n<li>\n<p>API \u52a0\u5bc6\u6df7\u6dc6 \u4e00\u4e9b\u63a5\u53e3\u8bf7\u6c42\u4f53\u3001\u8bf7\u6c42\u5934\u4e2d\u52a0\u5165 base64 \u7f16\u7801\u6570\u636e&#xff0c;\u63d0\u5347\u5206\u6790\u95e8\u69db<\/p>\n<\/li>\n<li>\n<p>\u7ed5\u8fc7\u9632\u706b\u5899\/\u89c4\u5219\u5339\u914d \u6709\u4e9b\u654f\u611f payload \u4f1a\u5148 base64 \u7f16\u7801\u518d\u4f20\u8f93&#xff0c;\u518d\u7531\u670d\u52a1\u5668\u89e3\u7801&#xff08;\u5982 WAF \u7ed5\u8fc7&#xff09;<\/p>\n<\/li>\n<li>\n<p>XSS \u7f16\u7801\u7ed5\u8fc7 \u628a\u6076\u610f\u811a\u672c base64 \u7f16\u7801\u540e&#xff0c;\u901a\u8fc7 eval(atob(&#8230;)) \u6267\u884c<\/p>\n<\/li>\n<\/ul>\n<p>eval(atob(&#034;YWxlcnQoJzEyMycp&#034;))  \/\/ alert(&#039;123&#039;)<\/p>\n<ul>\n<li>\n<p>JS\u9006\u5411\u4e2d\u5e38\u89c1\u52a0\u5bc6\u6d41\u7a0b \u591a\u5c42 Base64 \u7f16\u7801\u3001\u6df7\u6dc6\u548c\u52a0\u5bc6\u7ed3\u5408\u4f7f\u7528\u3002<\/p>\n<\/li>\n<\/ul>\n<h4>5.\u00a0\u5b89\u5168\u8bef\u533a\u4e0e\u653b\u51fb\u98ce\u9669<\/h4>\n<table>\n<tr>\u95ee\u9898\u8bf4\u660e<\/tr>\n<tbody>\n<tr>\n<td>\u4e0d\u662f\u52a0\u5bc6&#xff01;<\/td>\n<td>Base64 \u7f16\u7801\u540e\u770b\u8d77\u6765\u50cf\u52a0\u5bc6&#xff0c;\u4f46\u4efb\u4f55\u4eba\u90fd\u80fd\u89e3\u7801<\/td>\n<\/tr>\n<tr>\n<td>\u53ef\u88ab\u7206\u7834\/\u5206\u6790<\/td>\n<td>\u8bb8\u591a JS \u6587\u4ef6\u3001JWT payload \u90fd\u662f base64 \u7f16\u7801\u7684&#xff0c;\u53ef\u4ee5\u8fd8\u539f\u5f97\u5230\u5185\u5bb9<\/td>\n<\/tr>\n<tr>\n<td>\u53ef\u4ee5\u9690\u85cf XSS\u3001\u547d\u4ee4\u6ce8\u5165\u7b49 payload<\/td>\n<td>\u9700\u8981\u624b\u52a8\u89e3\u7801\u518d\u68c0\u6d4b<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6.\u00a0\u5b9e\u6218\u5206\u6790\u6848\u4f8b<\/h4>\n<p>JWT Payload \u89e3\u7801&#xff08;\u5178\u578b Base64URL&#xff09;<\/p>\n<p>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9<br \/>\n.<br \/>\neyJ1c2VyIjoiYWRtaW4iLCJpYXQiOjE2Nzk2NTg1NTV9<br \/>\n.<br \/>\n&lt;signature&gt;<\/p>\n<p>\u628a\u4e2d\u95f4\u4e24\u6bb5\u89e3\u7801\u5373\u53ef\u5f97\u5230 header \u548c payload \u4fe1\u606f\u3002<\/p>\n<p>Python \u811a\u672c\u89e3\u7801 JWT&#xff1a;<\/p>\n<p>import base64<br \/>\nimport json<\/p>\n<p>def decode_jwt_part(part):<br \/>\n    # Base64 padding \u8865\u9f50<br \/>\n    # JWT \u4f7f\u7528\u7684\u662f Base64 URL \u5b89\u5168\u7f16\u7801&#xff0c;\u5b83\u4f1a\u53bb\u6389 &#061; \u53f7\u6765\u51cf\u5c0f\u957f\u5ea6\u3002<br \/>\n    # \u4f46 Python \u89e3\u7801\u65f6\u9700\u8981\u6807\u51c6 Base64 \u683c\u5f0f&#xff08;\u5fc5\u987b\u662f 4 \u7684\u500d\u6570\u957f\u5ea6&#xff09;&#xff0c;\u6240\u4ee5\u8981\u8865 &#061;\u3002<br \/>\n    # -len(part) % 4 \u7684\u610f\u601d\u662f&#xff1a;\u6700\u5c11\u8865\u51e0\u4e2a &#061;&#xff0c;\u624d\u80fd\u4f7f\u957f\u5ea6\u53d8\u6210 4 \u7684\u500d\u6570<br \/>\n    part &#043;&#061; &#039;&#061;&#039; * (-len(part) % 4)  # padding<br \/>\n    return json.loads(base64.urlsafe_b64decode(part))<\/p>\n<p>print(decode_jwt_part(&#034;eyJ1c2VyIjoiYWRtaW4iLCJpYXQiOjE2Nzk2NTg1NTV9&#034;))<\/p>\n<h4>7.\u00a0\u5e38\u7528\u5de5\u5177<\/h4>\n<table>\n<tr>\u5de5\u5177\u529f\u80fd<\/tr>\n<tbody>\n<tr>\n<td>Python base64 \u6a21\u5757<\/td>\n<td>\u7f16\u89e3\u7801<\/td>\n<\/tr>\n<tr>\n<td>Burp Suite Decoder<\/td>\n<td>\u652f\u6301 Base64 \u591a\u5c42\u89e3\u7801<\/td>\n<\/tr>\n<tr>\n<td>\u5728\u7ebf\u7f51\u7ad9<\/td>\n<td>\u5982 base64decode.org<\/td>\n<\/tr>\n<tr>\n<td>Chrome \u63a7\u5236\u53f0<\/td>\n<td>btoa() \u7f16\u7801\u3001atob() \u89e3\u7801<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u9879\u76ee\u5185\u5bb9<\/tr>\n<tbody>\n<tr>\n<td>\u6bcf 3 \u5b57\u8282 \u2192 4 \u5b57\u7b26<\/td>\n<td>6bit \u5bf9\u5e94 1 \u4e2a base64 \u5b57\u7b26<\/td>\n<\/tr>\n<tr>\n<td>\u5b57\u7b26\u96c6<\/td>\n<td>A-Z, a-z, 0-9, &#043;, \/&#xff08;\u6216 URL \u4e2d\u7684 -, _&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u8865\u9f50<\/td>\n<td>\u4e0d\u8db3\u7528 &#061; \u8865\u9f50<\/td>\n<\/tr>\n<tr>\n<td>\u5b89\u5168\u610f\u4e49<\/td>\n<td>\u907f\u514d\u4f20\u8f93\u9519\u8bef\u3001\u9690\u85cf\u53c2\u6570\u3001\u6df7\u6dc6\u4f20\u8f93\u903b\u8f91<\/td>\n<\/tr>\n<tr>\n<td>\u98ce\u9669\u70b9<\/td>\n<td>\u53ef\u9006&#xff0c;\u4e0d\u7b49\u4e8e\u52a0\u5bc6&#xff0c;\u53ef\u4f5c\u4e3a\u7ed5\u8fc7\u5a92\u4ecb<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr \/>\n<h3>\u5341\u3001\u52a0\u5bc6\u4e0e\u6df7\u6dc6\u683c\u5f0f<\/h3>\n<p>\u5728 Web \u5b89\u5168\u4e2d&#xff0c;\u6211\u4eec\u7ecf\u5e38\u4f1a\u9047\u5230\u4e00\u4e9b\u4f20\u8f93\u53c2\u6570\u50cf\u8fd9\u6837&#xff1a;<\/p>\n<p>X-Qwert: U2FsdGVkX1&#043;K7NvMdq&#8230;<br \/>\ndata: 5a53486c6358526c5a6a49&#8230;<br \/>\nsign: KLi8rYuM&#043;j2kmdFrYzR2aA&#061;&#061;<\/p>\n<p>\u8fd9\u4e9b\u6570\u636e\u53ef\u80fd\u662f&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u52a0\u5bc6\u8fc7\u7684\u6570\u636e&#xff08;\u5982 AES\/RSA \u52a0\u5bc6&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u6df7\u6dc6\u5904\u7406\u540e\u7684\u53c2\u6570&#xff08;\u5982\u81ea\u5b9a\u4e49\u7f16\u7801\u3001Base64\u3001\u591a\u5c42\u8f6c\u6362&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u52a0\u5bc6 &#043; \u7f16\u7801 &#043; \u538b\u7f29\u7684\u591a\u5c42\u5904\u7406<\/p>\n<\/li>\n<\/ul>\n<h4>1.\u00a0\u52a0\u5bc6 vs \u6df7\u6dc6\u7684\u533a\u522b<\/h4>\n<table>\n<tr>\u9879\u76ee\u52a0\u5bc6\u6df7\u6dc6<\/tr>\n<tbody>\n<tr>\n<td>\u76ee\u7684<\/td>\n<td>\u4fdd\u969c\u673a\u5bc6\u6027\u3001\u907f\u514d\u88ab\u7834\u89e3<\/td>\n<td>\u589e\u52a0\u7406\u89e3\u3001\u9006\u5411\u96be\u5ea6<\/td>\n<\/tr>\n<tr>\n<td>\u662f\u5426\u53ef\u9006<\/td>\n<td>\u52a0\u5bc6\u901a\u5e38\u53ef\u9006&#xff08;\u5bf9\u79f0\/\u975e\u5bf9\u79f0&#xff09;<\/td>\n<td>\u6df7\u6dc6\u901a\u5e38\u53ef\u9006<\/td>\n<\/tr>\n<tr>\n<td>\u662f\u5426\u5b89\u5168<\/td>\n<td>\u5b89\u5168\u6027\u53d6\u51b3\u4e8e\u7b97\u6cd5\u548c\u5bc6\u94a5<\/td>\n<td>\u4e0d\u5b89\u5168&#xff0c;\u4ec5\u7528\u4e8e\u9690\u85cf\u903b\u8f91<\/td>\n<\/tr>\n<tr>\n<td>\u4f7f\u7528\u573a\u666f<\/td>\n<td>\u654f\u611f\u6570\u636e\u4f20\u8f93\u3001\u8eab\u4efd\u9a8c\u8bc1<\/td>\n<td>Web \u53c2\u6570\u3001JS \u51fd\u6570\u6df7\u6dc6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>2.\u00a0\u5e38\u89c1\u52a0\u5bc6\u7b97\u6cd5\u4e0e\u683c\u5f0f<\/h4>\n<p>\u5bf9\u79f0\u52a0\u5bc6<\/p>\n<ul>\n<li>\n<p>\u7b97\u6cd5&#xff1a;AES\u3001DES\u30013DES\u3001RC4<\/p>\n<\/li>\n<li>\n<p>\u7279\u70b9&#xff1a;\u52a0\u5bc6\u548c\u89e3\u5bc6\u4f7f\u7528\u540c\u4e00\u4e2a\u5bc6\u94a5<\/p>\n<\/li>\n<li>\n<p>\u683c\u5f0f\u7279\u5f81&#xff1a;\u52a0\u5bc6\u540e\u591a\u4e3a base64 \u7f16\u7801\u5b57\u7b26\u4e32\u6216 16 \u8fdb\u5236<\/p>\n<\/li>\n<\/ul>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>\/\/ AES \u52a0\u5bc6\u540e\u7684\u6570\u636e<br \/>\nU2FsdGVkX19yJwDkLNEpsjd3S1qzvFq&#8230;<\/p>\n<p>\u5173\u952e\u70b9&#xff1a;<\/p>\n<ul>\n<li>\u5982\u679c\u6570\u636e\u4ee5 U2FsdGVkX1 \u5f00\u5934&#xff0c;\u5f88\u53ef\u80fd\u662f CryptoJS \u7684 AES \u52a0\u5bc6&#xff08;OpenSSL \u683c\u5f0f&#xff09;<\/li>\n<\/ul>\n<p>\u975e\u5bf9\u79f0\u52a0\u5bc6<\/p>\n<ul>\n<li>\n<p>\u7b97\u6cd5&#xff1a;RSA\u3001ECC<\/p>\n<\/li>\n<li>\n<p>\u7279\u70b9&#xff1a;\u516c\u94a5\u52a0\u5bc6\u3001\u79c1\u94a5\u89e3\u5bc6<\/p>\n<\/li>\n<li>\n<p>\u683c\u5f0f\u7279\u5f81&#xff1a;<\/p>\n<ul>\n<li>\n<p>base64 \u7f16\u7801\u5927\u6bb5\u6570\u636e<\/p>\n<\/li>\n<li>\n<p>\u5f00\u5934\u53ef\u80fd\u662f &#034;&#8212;&#8211;BEGIN PUBLIC KEY&#8212;&#8211;&#034;<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\u5e38\u89c1\u683c\u5f0f&#xff1a;<\/p>\n<p>MIIBIjANBgkqhkiG9w0BAQEFAA&#8230;<\/p>\n<p>\u54c8\u5e0c\u7b97\u6cd5&#xff08;\u4e0d\u53ef\u9006&#xff09;<\/p>\n<ul>\n<li>\n<p>\u7b97\u6cd5&#xff1a;MD5\u3001SHA1\u3001SHA256<\/p>\n<\/li>\n<li>\n<p>\u7279\u70b9&#xff1a;\u4e0d\u53ef\u9006&#xff0c;\u5e38\u7528\u4e8e\u7b7e\u540d\u3001\u6821\u9a8c<\/p>\n<\/li>\n<li>\n<p>\u683c\u5f0f\u7279\u5f81&#xff1a;\u56fa\u5b9a\u957f\u5ea6 hex \u5b57\u7b26\u4e32&#xff08;32\/40\/64\u4f4d&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>\u793a\u4f8b&#xff1a;<\/p>\n<p>\u7b7e\u540d&#xff1a;ae2b1fca515949e5d54fb22b8ed95575  \/\/ MD5<\/p>\n<h4>3.\u00a0\u6df7\u6dc6\u683c\u5f0f\u4e3e\u4f8b<\/h4>\n<p>1&#xff09;Base64 \u6df7\u6dc6<\/p>\n<ul>\n<li>\n<p>\u52a0\u5bc6\u540e\u7528 Base64 \u7f16\u7801&#xff0c;\u4f7f\u5176\u53d8\u5f97\u201c\u53ef\u4f20\u8f93\u201d<\/p>\n<\/li>\n<li>\n<p>\u591a\u5c42 Base64 \u7f16\u7801\u4e5f\u5f88\u5e38\u89c1<\/p>\n<\/li>\n<\/ul>\n<p>let data &#061; &#034;YWJjZGVmZw&#061;&#061;&#034;;  \/\/ \u5b9e\u9645\u4e3a &#039;abcdefg&#039;<\/p>\n<p>2&#xff09;\u5b57\u7b26\u7f16\u7801\u6df7\u6dc6<\/p>\n<ul>\n<li>\u539f\u59cb\u5b57\u7b26\u4e32\u88ab\u8f6c\u4e3a Unicode \u7f16\u7801\u3001URL \u7f16\u7801\u3001\u5341\u516d\u8fdb\u5236\u7b49<\/li>\n<\/ul>\n<p>\\\\u0061\\\\u0062\\\\u0063        \/\/ &#039;abc&#039;<br \/>\n%61%62%63                \/\/ &#039;abc&#039; URL \u7f16\u7801<br \/>\n0x61 0x62 0x63           \/\/ \u5341\u516d\u8fdb\u5236 ASCII<\/p>\n<p>3&#xff09;\u51fd\u6570\u540d\u548c\u53d8\u91cf\u540d\u6df7\u6dc6<\/p>\n<p>var _0x8a21&#061;[&#034;\\\\x63\\\\x6F\\\\x6E\\\\x73\\\\x6F\\\\x6C\\\\x65&#034;];<br \/>\nconsole[_0x8a21[0]](&#034;hello&#034;);<\/p>\n<ul>\n<li>\n<p>\u8fd9\u91cc\u7684 console[&#034;log&#034;](&#034;hello&#034;) \u88ab\u6df7\u6dc6\u4e86<\/p>\n<\/li>\n<li>\n<p>\u7528\u4e8e JS \u53cd\u8c03\u8bd5\u3001\u53cd\u9006\u5411v<\/p>\n<\/li>\n<\/ul>\n<p>4&#xff09;\u81ea\u5b9a\u4e49\u53d8\u5f62\/\u52a0\u5bc6\u683c\u5f0f<\/p>\n<p>\u5f88\u591a APP \u548c JS \u4ee3\u7801\u4f1a\u81ea\u5df1\u5199\u4e00\u5957\u7f16\u7801\/\u6df7\u6dc6\u7b97\u6cd5&#xff0c;\u5982&#xff1a;<\/p>\n<ul>\n<li>\n<p>\u628a\u5b57\u7b26\u4e32\u6bcf\u4e2a\u5b57\u7b26 &#043;3&#xff08;Caesar&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u5f02\u6216\u52a0\u5bc6&#xff08;XOR&#xff09;<\/p>\n<\/li>\n<li>\n<p>\u5b57\u8282\u5012\u5e8f<\/p>\n<\/li>\n<li>\n<p>\u5b9a\u5236\u538b\u7f29\u7b97\u6cd5<\/p>\n<\/li>\n<\/ul>\n<p>\/\/ \u7b80\u5355\u7684\u5f02\u6216\u52a0\u5bc6<br \/>\nfunction xor(str, key) {<br \/>\n    return str.split(&#039;&#039;).map(c &#061;&gt; String.fromCharCode(c.charCodeAt(0) ^ key)).join(&#039;&#039;);<br \/>\n}<\/p>\n<h4>4.\u00a0\u653b\u51fb\u89d2\u5ea6&#xff1a;\u5982\u4f55\u5206\u6790\u52a0\u5bc6\u548c\u6df7\u6dc6&#xff1f;<\/h4>\n<p>1&#xff09;\u770b\u6570\u636e\u683c\u5f0f<\/p>\n<table>\n<tr>\u7279\u5f81\u53ef\u80fd\u662f\u4ec0\u4e48<\/tr>\n<tbody>\n<tr>\n<td>\u4ee5 U2FsdGVkX1 \u5f00\u5934<\/td>\n<td>AES &#043; OpenSSL&#xff08;CryptoJS&#xff09;<\/td>\n<\/tr>\n<tr>\n<td>\u5b57\u7b26\u5168\u90e8\u4e3a hex<\/td>\n<td>AES\/RC4\/raw-byte<\/td>\n<\/tr>\n<tr>\n<td>\u957f\u5ea6\u56fa\u5b9a<\/td>\n<td>Hash&#xff0c;\u5982 MD5\/SHA1<\/td>\n<\/tr>\n<tr>\n<td>\u591a\u5c42 base64<\/td>\n<td>\u6df7\u6dc6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>2&#xff09;\u67e5\u4ee3\u7801\u5173\u952e\u70b9<\/p>\n<ul>\n<li>\n<p>\u641c\u7d22&#xff1a;CryptoJS, AES, RSA, encrypt, sign, btoa, atob<\/p>\n<\/li>\n<li>\n<p>\u67e5\u770b\u6570\u636e\u6784\u9020\u3001\u53c2\u6570\u751f\u6210\u903b\u8f91<\/p>\n<\/li>\n<li>\n<p>\u627e\u6df7\u6dc6\u51fd\u6570\u3001\u624b\u52a8\u8fd8\u539f&#xff08;AST \u5206\u6790\u3001\u52a8\u6001\u8c03\u8bd5&#xff09;<\/p>\n<\/li>\n<\/ul>\n<p>3&#xff09;\u52a8\u6001\u8c03\u8bd5\u5b9a\u4f4d\u52a0\u5bc6\u903b\u8f91<\/p>\n<ul>\n<li>\n<p>\u4f7f\u7528\u6d4f\u89c8\u5668\u65ad\u70b9\u8c03\u8bd5&#xff08;XHR\u3001\u4e8b\u4ef6\u89e6\u53d1&#xff09;<\/p>\n<\/li>\n<li>\n<p>Hook JS \u51fd\u6570&#xff08;\u5982&#xff1a;CryptoJS.encrypt\u3001btoa&#xff09;<\/p>\n<\/li>\n<li>\n<p>Frida \u6ce8\u5165 APP \u52a0\u5bc6\u51fd\u6570\u4e2d\u95f4\u53c2\u6570<\/p>\n<\/li>\n<\/ul>\n<h4>5.\u00a0Web \u5b89\u5168\u4e2d\u52a0\u5bc6\u4e0e\u6df7\u6dc6\u7684\u5b9e\u6218\u5e94\u7528<\/h4>\n<table>\n<tr>\u573a\u666f\u52a0\u5bc6\/\u6df7\u6dc6\u7528\u6cd5<\/tr>\n<tbody>\n<tr>\n<td>\u767b\u5f55\u4f20\u53c2<\/td>\n<td>\u5bc6\u7801 AES\/RSA \u52a0\u5bc6&#xff0c;\u9632\u6b62\u88ab\u6293\u5305\u91cd\u653e<\/td>\n<\/tr>\n<tr>\n<td>\u53c2\u6570\u6821\u9a8c<\/td>\n<td>\u7528 sign\/signature \u7b7e\u540d\u53c2\u6570\u9632\u7be1\u6539<\/td>\n<\/tr>\n<tr>\n<td>WebSocket \u901a\u8baf<\/td>\n<td>\u4f7f\u7528 base64 &#043; AES \u5c01\u88c5\u6d88\u606f<\/td>\n<\/tr>\n<tr>\n<td>JS \u53cd\u8c03\u8bd5<\/td>\n<td>\u6240\u6709\u5173\u952e\u53d8\u91cf\u3001\u51fd\u6570\u540d\u6df7\u6dc6&#xff0c;\u914d\u5408\u52a8\u6001\u5bc6\u94a5<\/td>\n<\/tr>\n<tr>\n<td>JS\u9006\u5411\u4fdd\u62a4<\/td>\n<td>\u81ea\u5b9a\u4e49\u7684\u7b97\u6cd5\u6df7\u6dc6\u51fd\u6570\u903b\u8f91&#xff0c;\u52a8\u6001\u89e3\u5bc6\u6267\u884c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>6. \u5de5\u5177\u63a8\u8350<\/h4>\n<table>\n<tr>\u5de5\u5177\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>Burp Suite &#043; Decoder<\/td>\n<td>\u62c6\u89e3\u591a\u5c42\u6df7\u6dc6<\/td>\n<\/tr>\n<tr>\n<td>JSDetox\u3001AST Explorer<\/td>\n<td>\u8fd8\u539f JS \u6df7\u6dc6\u4ee3\u7801<\/td>\n<\/tr>\n<tr>\n<td>CyberChef<\/td>\n<td>\u53ef\u89c6\u5316\u591a\u5c42\u89e3\u7801<\/td>\n<\/tr>\n<tr>\n<td>Frida<\/td>\n<td>Hook APP \u52a0\u5bc6\u903b\u8f91<\/td>\n<\/tr>\n<tr>\n<td>Python &#043; Crypto \u5e93<\/td>\n<td>\u81ea\u5b9a\u4e49\u811a\u672c\u89e3\u5bc6<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h4>\u603b\u7ed3<\/h4>\n<table>\n<tr>\u52a0\u5bc6\u65b9\u5f0f\u7279\u5f81\u8868\u73b0\u5e38\u89c1\u7528\u9014<\/tr>\n<tbody>\n<tr>\n<td>Base64 \u591a\u5c42<\/td>\n<td>\u53ea\u8981 atob \u591a\u6b21\u5373\u53ef\u8fd8\u539f<\/td>\n<td>\u6570\u636e\u6df7\u6dc6<\/td>\n<\/tr>\n<tr>\n<td>AES &#043; base64<\/td>\n<td>CryptoJS \u660e\u6587\u52a0\u5bc6\u540e\u518d\u7f16\u7801<\/td>\n<td>\u767b\u5f55\u3001\u53c2\u6570<\/td>\n<\/tr>\n<tr>\n<td>RSA &#043; base64<\/td>\n<td>\u4e00\u822c\u53ea\u52a0\u5bc6\u90e8\u5206\u6570\u636e&#xff08;\u5982\u5bc6\u7801&#xff09;<\/td>\n<td>\u767b\u5f55\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>MD5\u3001SHA \u7b7e\u540d<\/td>\n<td>\u56fa\u5b9a 32\/64 \u957f\u5ea6&#xff0c;\u975e\u53ef\u9006<\/td>\n<td>\u9632\u7be1\u6539<\/td>\n<\/tr>\n<tr>\n<td>\u5f02\u6216\u3001\u5012\u5e8f\u3001\u53d8\u5f62<\/td>\n<td>\u6570\u636e\u65e0\u56fa\u5b9a\u957f\u5ea6&#xff0c;\u65e0\u5e93\u4f9d\u8d56<\/td>\n<td>\u9690\u85cf\u7b97\u6cd5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.4k\u6b21\uff0c\u70b9\u8d5e20\u6b21\uff0c\u6536\u85cf24\u6b21\u3002\u5185\u5bb9\u8bf4\u660eHTTP \u8bf7\u6c42\u8bf7\u6c42\u884c + \u8bf7\u6c42\u5934 + \u7a7a\u884c + \u8bf7\u6c42\u4f53\uff08\u53ef\u9009\uff09HTTP \u54cd\u5e94\u72b6\u6001\u884c + \u54cd\u5e94\u5934 + \u7a7a\u884c + \u54cd\u5e94\u4f53\u72b6\u6001\u78011xx\u4fe1\u606f\uff0c2xx\u6210\u529f\uff0c3xx\u91cd\u5b9a\u5411\uff0c4xx\u5ba2\u6237\u7aef\u9519\uff0c5xx\u670d\u52a1\u5668\u9519HTTPSHTTP + SSL\/TLS\u52a0\u5bc6HTTPS \u5de5\u4f5c\u6d41\u7a0b\u8bc1\u4e66\u4ea4\u6362\u3001\u5bc6\u94a5\u534f\u5546\u3001\u52a0\u5bc6\u901a\u4fe1\u5c5e\u6027\u7528\u9014\u662f\u5426\u53ef\u9632\u653b\u51fbHttpOnly\u7981\u6b62 JS \u8bbf\u95ee\u9632\u6b62 XSSSecure\u53ea\u5728 HTTPS \u4f20\u8f93\u9632\u6b62 MITMSameSite\u8de8\u7ad9\u8bf7\u6c42\u9650\u5236\u9632\u6b62 CSRFExpires\u3002<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[275,61],"topic":[],"class_list":["post-39873","post","type-post","status-publish","format-standard","hentry","category-server","tag-web","tag-61"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/39873.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.4k\u6b21\uff0c\u70b9\u8d5e20\u6b21\uff0c\u6536\u85cf24\u6b21\u3002\u5185\u5bb9\u8bf4\u660eHTTP \u8bf7\u6c42\u8bf7\u6c42\u884c + \u8bf7\u6c42\u5934 + \u7a7a\u884c + \u8bf7\u6c42\u4f53\uff08\u53ef\u9009\uff09HTTP \u54cd\u5e94\u72b6\u6001\u884c + \u54cd\u5e94\u5934 + \u7a7a\u884c + \u54cd\u5e94\u4f53\u72b6\u6001\u78011xx\u4fe1\u606f\uff0c2xx\u6210\u529f\uff0c3xx\u91cd\u5b9a\u5411\uff0c4xx\u5ba2\u6237\u7aef\u9519\uff0c5xx\u670d\u52a1\u5668\u9519HTTPSHTTP + SSL\/TLS\u52a0\u5bc6HTTPS \u5de5\u4f5c\u6d41\u7a0b\u8bc1\u4e66\u4ea4\u6362\u3001\u5bc6\u94a5\u534f\u5546\u3001\u52a0\u5bc6\u901a\u4fe1\u5c5e\u6027\u7528\u9014\u662f\u5426\u53ef\u9632\u653b\u51fbHttpOnly\u7981\u6b62 JS \u8bbf\u95ee\u9632\u6b62 XSSSecure\u53ea\u5728 HTTPS \u4f20\u8f93\u9632\u6b62 MITMSameSite\u8de8\u7ad9\u8bf7\u6c42\u9650\u5236\u9632\u6b62 CSRFExpires\u3002\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/39873.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-26T02:33:23+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/39873.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/39873.html\",\"name\":\"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2025-05-26T02:33:23+00:00\",\"dateModified\":\"2025-05-26T02:33:23+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/39873.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/39873.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/39873.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/39873.html","og_locale":"zh_CN","og_type":"article","og_title":"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u6587\u7ae0\u6d4f\u89c8\u9605\u8bfb1.4k\u6b21\uff0c\u70b9\u8d5e20\u6b21\uff0c\u6536\u85cf24\u6b21\u3002\u5185\u5bb9\u8bf4\u660eHTTP \u8bf7\u6c42\u8bf7\u6c42\u884c + \u8bf7\u6c42\u5934 + \u7a7a\u884c + \u8bf7\u6c42\u4f53\uff08\u53ef\u9009\uff09HTTP \u54cd\u5e94\u72b6\u6001\u884c + \u54cd\u5e94\u5934 + \u7a7a\u884c + \u54cd\u5e94\u4f53\u72b6\u6001\u78011xx\u4fe1\u606f\uff0c2xx\u6210\u529f\uff0c3xx\u91cd\u5b9a\u5411\uff0c4xx\u5ba2\u6237\u7aef\u9519\uff0c5xx\u670d\u52a1\u5668\u9519HTTPSHTTP + SSL\/TLS\u52a0\u5bc6HTTPS \u5de5\u4f5c\u6d41\u7a0b\u8bc1\u4e66\u4ea4\u6362\u3001\u5bc6\u94a5\u534f\u5546\u3001\u52a0\u5bc6\u901a\u4fe1\u5c5e\u6027\u7528\u9014\u662f\u5426\u53ef\u9632\u653b\u51fbHttpOnly\u7981\u6b62 JS \u8bbf\u95ee\u9632\u6b62 XSSSecure\u53ea\u5728 HTTPS \u4f20\u8f93\u9632\u6b62 MITMSameSite\u8de8\u7ad9\u8bf7\u6c42\u9650\u5236\u9632\u6b62 CSRFExpires\u3002","og_url":"https:\/\/www.wsisp.com\/helps\/39873.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2025-05-26T02:33:23+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"15 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/39873.html","url":"https:\/\/www.wsisp.com\/helps\/39873.html","name":"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2025-05-26T02:33:23+00:00","dateModified":"2025-05-26T02:33:23+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/39873.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/39873.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/39873.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"\u5173\u4e8e Web\u5b89\u5168\uff1a1. Web \u5b89\u5168\u57fa\u7840\u77e5\u8bc6"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/39873","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=39873"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/39873\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=39873"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=39873"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=39873"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=39873"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}