400 Bad Request\u8868\u793a\u670d\u52a1\u5668\u7531\u4e8e\u88ab\u8ba4\u4e3a\u662f\u5ba2\u6237\u7aef\u9519\u8bef（\u4f8b\u5982，\u8bf7\u6c42\u8bed\u6cd5\u9519\u8bef\u3001\u65e0\u6548\u7684\u8bf7\u6c42\u6d88\u606f\u5e27\u6216\u6b3a\u9a97\u6027\u8bf7\u6c42\u8def\u7531）\u800c\u65e0\u6cd5\u6216\u4e0d\u4f1a\u5904\u7406\u8bf7\u6c42\u3002<\/p>\n
\u5173\u952e\u7279\u6027：<\/p>\n
\u901a\u7528\u578b\u5ba2\u6237\u7aef\u9519\u8bef\u72b6\u6001\u7801<\/p>\n<\/li>\n
\u4e0d\u533a\u5206\u5177\u4f53\u9519\u8bef\u7c7b\u578b\u65f6\u7684\u9ed8\u8ba4\u9009\u62e9<\/p>\n<\/li>\n
\u901a\u5e38\u610f\u5473\u7740\u8bf7\u6c42\u672c\u8eab\u5b58\u5728\u95ee\u9898<\/p>\n<\/li>\n<\/ul>\n
http<\/p>\n
# \u793a\u4f8b1：\u65e0\u6548\u7684HTTP\u534f\u8bae\u683c\u5f0f
\nGET \/api\/users HTTP\/1.1
\nHost: example.com
\n# \u7f3a\u5c11\u5fc5\u8981\u7684\u7a7a\u884c\u5206\u9694\u5934\u90e8\u548c\u4e3b\u4f53<\/p>\n
# \u793a\u4f8b2：JSON\u683c\u5f0f\u9519\u8bef
\nPOST \/api\/users HTTP\/1.1
\nContent-Type: application\/json<\/p>\n
{
\n "name": "John",
\n "age": 30,
\n "email": "john@example.com"
\n # \u6ce8\u610f：\u672b\u5c3e\u7f3a\u5c11\u95ed\u5408\u7684\u5927\u62ec\u53f7
\n}<\/p>\n
json<\/p>\n
\/\/ \u8bf7\u6c42\u4f53\u6570\u636e\u4e0d\u7b26\u5408\u6a21\u5f0f\u8981\u6c42
\n{
\n "username": "ab", \/\/ \u957f\u5ea6\u4e0d\u8db33\u5b57\u7b26
\n "email": "invalid-email", \/\/ \u90ae\u7bb1\u683c\u5f0f\u9519\u8bef
\n "age": -5 \/\/ \u5e74\u9f84\u4e3a\u8d1f\u6570
\n}<\/p>\n
http<\/p>\n
# \u5fc5\u9700\u67e5\u8be2\u53c2\u6570\u672a\u63d0\u4f9b
\nGET \/api\/search?query= HTTP\/1.1 # query\u53c2\u6570\u4e3a\u7a7a<\/p>\n
POST \/api\/register HTTP\/1.1
\nContent-Type: application\/json<\/p>\n
{
\n "username": "john",
\n "email": "john@example.com"
\n # \u7f3a\u5931\u5fc5\u9700\u7684password\u5b57\u6bb5
\n}<\/p>\n
json<\/p>\n
{
\n "error": {
\n "code": "VALIDATION_ERROR",
\n "message": "\u8bf7\u6c42\u6570\u636e\u9a8c\u8bc1\u5931\u8d25",
\n "details": [
\n {
\n "field": "email",
\n "error": "INVALID_FORMAT",
\n "message": "\u90ae\u7bb1\u5730\u5740\u683c\u5f0f\u4e0d\u6b63\u786e"
\n },
\n {
\n "field": "password",
\n "error": "LENGTH_TOO_SHORT",
\n "message": "\u5bc6\u7801\u957f\u5ea6\u81f3\u5c11\u4e3a8\u4e2a\u5b57\u7b26",
\n "constraint": {
\n "min": 8,
\n "actual": 5
\n }
\n }
\n ],
\n "timestamp": "2024-01-15T10:30:00Z",
\n "request_id": "req_1234567890abcdef"
\n }
\n}<\/p>\n
python<\/p>\n
# Python\u793a\u4f8b：\u8bf7\u6c42\u9a8c\u8bc1\u4e2d\u95f4\u4ef6
\nfrom typing import Dict, List, Optional
\nfrom pydantic import BaseModel, ValidationError, validator
\nimport json<\/p>\n
class ValidationResult:
\n def __init__(self):
\n self.is_valid = True
\n self.errors = []<\/p>\n
def add_error(self, field: str, code: str, message: str):
\n self.is_valid = False
\n self.errors.append({
\n "field": field,
\n "code": code,
\n "message": message
\n })<\/p>\n
class RequestValidator:
\n @staticmethod
\n def validate_json_syntax(body: str) -> ValidationResult:
\n result = ValidationResult()
\n try:
\n json.loads(body)
\n except json.JSONDecodeError as e:
\n result.add_error(
\n field="$body",
\n code="INVALID_JSON",
\n message=f"JSON\u8bed\u6cd5\u9519\u8bef: {str(e)}"
\n )
\n return result<\/p>\n
@staticmethod
\n def validate_content_type(headers: Dict) -> ValidationResult:
\n result = ValidationResult()
\n content_type = headers.get("Content-Type", "")<\/p>\n
if not content_type:
\n result.add_error(
\n field="Content-Type",
\n code="MISSING_HEADER",
\n message="Content-Type\u5934\u5fc5\u987b\u63d0\u4f9b"
\n )
\n elif "application\/json" not in content_type:
\n result.add_error(
\n field="Content-Type",
\n code="UNSUPPORTED_MEDIA_TYPE",
\n message="\u4ec5\u652f\u6301application\/json\u683c\u5f0f"
\n )
\n return result<\/p>\n
# \u4f7f\u7528Pydantic\u8fdb\u884c\u6570\u636e\u9a8c\u8bc1
\nclass UserCreateRequest(BaseModel):
\n username: str
\n email: str
\n password: str<\/p>\n
@validator('username')
\n def validate_username(cls, v):
\n if len(v) < 3:
\n raise ValueError('\u7528\u6237\u540d\u81f3\u5c113\u4e2a\u5b57\u7b26')
\n if not v.isalnum():
\n raise ValueError('\u7528\u6237\u540d\u53ea\u80fd\u5305\u542b\u5b57\u6bcd\u548c\u6570\u5b57')
\n return v<\/p>\n
@validator('email')
\n def validate_email(cls, v):
\n # \u7b80\u5316\u7684\u90ae\u7bb1\u9a8c\u8bc1
\n if '@' not in v or '.' not in v.split('@')[-1]:
\n raise ValueError('\u65e0\u6548\u7684\u90ae\u7bb1\u5730\u5740')
\n return v<\/p>\n
@validator('password')
\n def validate_password(cls, v):
\n if len(v) < 8:
\n raise ValueError('\u5bc6\u7801\u81f3\u5c118\u4e2a\u5b57\u7b26')
\n return v<\/p>\n
javascript<\/p>\n
\/\/ Node.js\/Express\u793a\u4f8b：\u5168\u5c40400\u9519\u8bef\u5904\u7406
\napp.use((err, req, res, next) => {
\n if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
\n \/\/ JSON\u89e3\u6790\u9519\u8bef
\n return res.status(400).json({
\n error: {
\n code: 'INVALID_JSON',
\n message: '\u8bf7\u6c42\u4f53\u5305\u542b\u65e0\u6548\u7684JSON',
\n details: {
\n position: err.message.match(\/at position (\\\\d+)\/)?.[1],
\n suggestion: '\u8bf7\u68c0\u67e5JSON\u683c\u5f0f\u662f\u5426\u6b63\u786e'
\n }
\n }
\n });
\n }<\/p>\n
if (err instanceof ValidationError) {
\n \/\/ Joi\u6216\u7c7b\u4f3c\u9a8c\u8bc1\u5e93\u7684\u9519\u8bef
\n return res.status(400).json({
\n error: {
\n code: 'VALIDATION_FAILED',
\n message: '\u8bf7\u6c42\u6570\u636e\u9a8c\u8bc1\u5931\u8d25',
\n details: err.details.map(detail => ({
\n field: detail.path.join('.'),
\n type: detail.type,
\n message: detail.message
\n }))
\n }
\n });
\n }<\/p>\n
\/\/ \u5176\u4ed6400\u9519\u8bef
\n if (err.status === 400) {
\n return res.status(400).json({
\n error: {
\n code: err.code || 'BAD_REQUEST',
\n message: err.message || '\u8bf7\u6c42\u683c\u5f0f\u4e0d\u6b63\u786e',
\n details: err.details
\n }
\n });
\n }<\/p>\n
next(err);
\n});<\/p>\n
javascript<\/p>\n
\/\/ \u5ba2\u6237\u7aef：\u667a\u80fd\u91cd\u8bd5\u903b\u8f91
\nclass RequestHandler {
\n constructor(maxRetries = 3) {
\n this.maxRetries = maxRetries;
\n }<\/p>\n
async sendRequest(requestFn, data) {
\n let lastError;<\/p>\n
for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
\n try {
\n return await requestFn(data);
\n } catch (error) {
\n lastError = error;<\/p>\n
if (error.response?.status === 400) {
\n \/\/ \u5206\u6790\u9519\u8bef\u7c7b\u578b
\n const errorData = error.response.data;<\/p>\n
\/\/ \u5982\u679c\u662f\u53ef\u4fee\u590d\u7684\u9519\u8bef，\u5c1d\u8bd5\u4fee\u590d\u540e\u91cd\u8bd5
\n if (this.isFixableError(errorData)) {
\n data = this.fixRequestData(data, errorData);
\n continue;
\n }<\/p>\n
\/\/ \u5982\u679c\u662f\u5ba2\u6237\u7aef\u4ee3\u7801\u95ee\u9898，\u4e0d\u91cd\u8bd5
\n if (this.isClientBug(errorData)) {
\n throw new Error('\u5ba2\u6237\u7aef\u4ee3\u7801\u9700\u8981\u4fee\u590d: ' +
\n JSON.stringify(errorData));
\n }
\n }<\/p>\n
\/\/ \u5176\u4ed6\u9519\u8bef，\u6839\u636e\u9000\u907f\u7b56\u7565\u7b49\u5f85\u540e\u91cd\u8bd5
\n if (attempt < this.maxRetries) {
\n await this.delay(this.calculateBackoff(attempt));
\n }
\n }
\n }<\/p>\n
throw lastError;
\n }<\/p>\n
isFixableError(errorData) {
\n \/\/ \u68c0\u67e5\u9519\u8bef\u662f\u5426\u53ef\u4ee5\u901a\u8fc7\u5ba2\u6237\u7aef\u4fee\u590d
\n const fixableCodes = [
\n 'MISSING_FIELD',
\n 'INVALID_FORMAT',
\n 'VALUE_TOO_SHORT'
\n ];<\/p>\n
return errorData.details?.some(detail =>
\n fixableCodes.includes(detail.code)
\n );
\n }<\/p>\n
fixRequestData(data, errorData) {
\n \/\/ \u6839\u636e\u9519\u8bef\u8be6\u60c5\u4fee\u590d\u6570\u636e
\n const fixedData = { …data };<\/p>\n
errorData.details?.forEach(detail => {
\n if (detail.code === 'MISSING_FIELD') {
\n \/\/ \u6dfb\u52a0\u7f3a\u5931\u7684\u5b57\u6bb5（\u5982\u679c\u77e5\u9053\u9ed8\u8ba4\u503c）
\n if (detail.field === 'timezone') {
\n fixedData.timezone = 'UTC';
\n }
\n }
\n });<\/p>\n
return fixedData;
\n }<\/p>\n
calculateBackoff(attempt) {
\n \/\/ \u6307\u6570\u9000\u907f
\n return Math.min(1000 * Math.pow(2, attempt), 10000);
\n }<\/p>\n
delay(ms) {
\n return new Promise(resolve => setTimeout(resolve, ms));
\n }
\n}<\/p>\n
jsx<\/p>\n
\/\/ React\u7ec4\u4ef6：\u7528\u6237\u53cb\u597d\u7684\u9519\u8bef\u5c55\u793a
\nfunction BadRequestDisplay({ error }) {
\n const [expanded, setExpanded] = useState(false);<\/p>\n
const groupErrors = (details) => {
\n const groups = {
\n required: [],
\n format: [],
\n validation: [],
\n other: []
\n };<\/p>\n
details?.forEach(detail => {
\n if (detail.code.includes('MISSING') || detail.code.includes('REQUIRED')) {
\n groups.required.push(detail);
\n } else if (detail.code.includes('FORMAT') || detail.code.includes('INVALID')) {
\n groups.format.push(detail);
\n } else if (detail.code.includes('VALIDATION')) {
\n groups.validation.push(detail);
\n } else {
\n groups.other.push(detail);
\n }
\n });<\/p>\n
return groups;
\n };<\/p>\n
const renderFieldError = (detail) => (
\n <div key={`${detail.field}-${detail.code}`} className="field-error">
\n <strong>{detail.field}:<\/strong>
\n <span>{detail.message}<\/span>
\n {detail.suggestion && (
\n <div className="suggestion">
\n 💡 \u5efa\u8bae: {detail.suggestion}
\n <\/div>
\n )}
\n <\/div>
\n );<\/p>\n
const errorGroups = groupErrors(error.details);<\/p>\n
return (
\n <div className="error-container bad-request">
\n <div className="error-header">
\n <AlertTriangle size={24} \/>
\n <h3>{error.message}<\/h3>
\n <button
\n onClick={() => setExpanded(!expanded)}
\n className="toggle-details"
\n >
\n {expanded ? '\u9690\u85cf\u8be6\u60c5' : '\u663e\u793a\u8be6\u60c5'}
\n <\/button>
\n <\/div><\/p>\n
{expanded && (
\n <div className="error-details">
\n {errorGroups.required.length > 0 && (
\n <div className="error-group">
\n <h4>\u274c \u7f3a\u5931\u5fc5\u8981\u4fe1\u606f<\/h4>
\n {errorGroups.required.map(renderFieldError)}
\n <\/div>
\n )}<\/p>\n
{errorGroups.format.length > 0 && (
\n <div className="error-group">
\n <h4>📝 \u683c\u5f0f\u95ee\u9898<\/h4>
\n {errorGroups.format.map(renderFieldError)}
\n <\/div>
\n )}<\/p>\n
{errorGroups.validation.length > 0 && (
\n <div className="error-group">
\n <h4>\u26a1 \u9a8c\u8bc1\u9519\u8bef<\/h4>
\n {errorGroups.validation.map(renderFieldError)}
\n <\/div>
\n )}<\/p>\n
{error.code && (
\n <div className="technical-info">
\n <small>\u9519\u8bef\u4ee3\u7801: {error.code}<\/small>
\n {error.request_id && (
\n <small>\u8bf7\u6c42ID: {error.request_id}<\/small>
\n )}
\n <\/div>
\n )}
\n <\/div>
\n )}<\/p>\n
<div className="error-actions">
\n <button onClick={() => window.location.reload()}>
\n \u5237\u65b0\u9875\u9762
\n <\/button>
\n <button onClick={() => window.history.back()}>
\n \u8fd4\u56de\u4e0a\u4e00\u9875
\n <\/button>
\n <button onClick={() => {\/* \u663e\u793a\u5e2e\u52a9\u6587\u6863 *\/}}>
\n \u67e5\u770b\u5e2e\u52a9
\n <\/button>
\n <\/div>
\n <\/div>
\n );
\n}<\/p>\n
python<\/p>\n
# \u76d1\u63a7400\u9519\u8bef\u7684\u4e2d\u95f4\u4ef6
\nimport time
\nfrom collections import defaultdict
\nfrom typing import Dict, Any
\nimport logging
\nfrom dataclasses import dataclass, asdict
\nfrom datetime import datetime<\/p>\n
@dataclass
\nclass BadRequestMetrics:
\n endpoint: str
\n error_count: int = 0
\n error_types: Dict[str, int] = None
\n user_agents: Dict[str, int] = None
\n last_occurrence: datetime = None<\/p>\n
def __post_init__(self):
\n if self.error_types is None:
\n self.error_types = defaultdict(int)
\n if self.user_agents is None:
\n self.user_agents = defaultdict(int)<\/p>\n
def record_error(self, error_code: str, user_agent: str):
\n self.error_count += 1
\n self.error_types[error_code] += 1
\n self.user_agents[user_agent] += 1
\n self.last_occurrence = datetime.utcnow()<\/p>\n
class BadRequestMonitor:
\n def __init__(self):
\n self.metrics: Dict[str, BadRequestMetrics] = {}
\n self.logger = logging.getLogger('bad_request_monitor')<\/p>\n
def record(self, request, error_code: str):
\n endpoint = request.path<\/p>\n
if endpoint not in self.metrics:
\n self.metrics[endpoint] = BadRequestMetrics(endpoint=endpoint)<\/p>\n
metrics = self.metrics[endpoint]
\n metrics.record_error(error_code, request.headers.get('User-Agent', 'unknown'))<\/p>\n
# \u8bb0\u5f55\u8be6\u7ec6\u65e5\u5fd7
\n self.logger.warning({
\n 'event': 'bad_request',
\n 'endpoint': endpoint,
\n 'error_code': error_code,
\n 'method': request.method,
\n 'user_agent': request.headers.get('User-Agent'),
\n 'referer': request.headers.get('Referer'),
\n 'ip': request.remote_addr,
\n 'timestamp': datetime.utcnow().isoformat()
\n })<\/p>\n
def get_report(self) -> Dict[str, Any]:
\n report = {
\n 'total_errors': sum(m.error_count for m in self.metrics.values()),
\n 'endpoints': {}
\n }<\/p>\n
for endpoint, metrics in self.metrics.items():
\n report['endpoints'][endpoint] = {
\n 'error_count': metrics.error_count,
\n 'error_types': dict(metrics.error_types),
\n 'top_user_agents': dict(
\n sorted(
\n metrics.user_agents.items(),
\n key=lambda x: x[1],
\n reverse=True
\n )[:5]
\n ),
\n 'last_occurrence': metrics.last_occurrence.isoformat()
\n if metrics.last_occurrence else None
\n }<\/p>\n
return report<\/p>\n
def reset_metrics(self):
\n self.metrics.clear()<\/p>\n
# Flask\u4e2d\u95f4\u4ef6\u793a\u4f8b
\nfrom flask import request, g
\nimport json<\/p>\n
bad_request_monitor = BadRequestMonitor()<\/p>\n
@app.before_request
\ndef start_request_timer():
\n g.start_time = time.time()<\/p>\n
@app.after_request
\ndef monitor_bad_requests(response):
\n if response.status_code == 400:
\n try:
\n error_data = json.loads(response.get_data(as_text=True))
\n error_code = error_data.get('error', {}).get('code', 'UNKNOWN')
\n except:
\n error_code = 'UNKNOWN'<\/p>\n
bad_request_monitor.record(request, error_code)<\/p>\n
# \u8bb0\u5f55\u54cd\u5e94\u65f6\u95f4
\n if hasattr(g, 'start_time'):
\n response_time = (time.time() – g.start_time) * 1000
\n response.headers['X-Response-Time'] = f'{response_time:.2f}ms'<\/p>\n
return response<\/p>\n
javascript<\/p>\n
\/\/ \u6d4f\u89c8\u5668\u5f00\u53d1\u8005\u5de5\u5177\u6269\u5c55：\u8bf7\u6c42\u8bca\u65ad
\nclass RequestDiagnosticTool {
\n constructor() {
\n this.capturedRequests = [];
\n this.init();
\n }<\/p>\n
init() {
\n \/\/ \u62e6\u622aXMLHttpRequest\u548cFetch\u8bf7\u6c42
\n this.interceptXMLHttpRequest();
\n this.interceptFetch();<\/p>\n
\/\/ \u6dfb\u52a0UI\u5230\u5f00\u53d1\u8005\u5de5\u5177
\n this.addToDevTools();
\n }<\/p>\n
interceptXMLHttpRequest() {
\n const originalOpen = XMLHttpRequest.prototype.open;
\n const originalSend = XMLHttpRequest.prototype.send;<\/p>\n
XMLHttpRequest.prototype.open = function(method, url) {
\n this._diagnostic = {
\n method,
\n url,
\n startTime: Date.now(),
\n headers: {}
\n };<\/p>\n
return originalOpen.apply(this, arguments);
\n };<\/p>\n
XMLHttpRequest.prototype.send = function(body) {
\n this._diagnostic.requestBody = body;
\n this._diagnostic.requestHeaders = this.getAllResponseHeaders();<\/p>\n
this.addEventListener('load', () => {
\n this._diagnostic.endTime = Date.now();
\n this._diagnostic.status = this.status;
\n this._diagnostic.response = this.responseText;<\/p>\n
if (this.status === 400) {
\n this.analyzeBadRequest(this._diagnostic);
\n }
\n });<\/p>\n
return originalSend.apply(this, arguments);
\n };
\n }<\/p>\n
analyzeBadRequest(request) {
\n const analysis = {
\n url: request.url,
\n method: request.method,
\n duration: request.endTime – request.startTime,
\n issues: []
\n };<\/p>\n
try {
\n const response = JSON.parse(request.response);<\/p>\n
\/\/ \u5206\u6790\u5e38\u89c1\u95ee\u9898\u6a21\u5f0f
\n if (response.error?.details) {
\n response.error.details.forEach(detail => {
\n analysis.issues.push({
\n type: 'VALIDATION_ERROR',
\n field: detail.field,
\n message: detail.message,
\n suggestion: this.getSuggestion(detail)
\n });
\n });
\n }<\/p>\n
\/\/ \u68c0\u67e5\u8bf7\u6c42\u5934
\n if (!request.headers['Content-Type']?.includes('application\/json')) {
\n analysis.issues.push({
\n type: 'HEADER_ISSUE',
\n field: 'Content-Type',
\n message: '\u53ef\u80fd\u7f3a\u5c11\u6216\u9519\u8bef\u7684Content-Type\u5934',
\n suggestion: '\u6dfb\u52a0: Content-Type: application\/json'
\n });
\n }<\/p>\n
this.capturedRequests.push(analysis);
\n this.displayAnalysis(analysis);
\n } catch (e) {
\n console.error('Failed to analyze bad request:', e);
\n }
\n }<\/p>\n
getSuggestion(detail) {
\n const suggestions = {
\n 'INVALID_JSON': '\u68c0\u67e5JSON\u8bed\u6cd5，\u786e\u4fdd\u5f15\u53f7\u5339\u914d\u3001\u9017\u53f7\u6b63\u786e',
\n 'MISSING_FIELD': '\u68c0\u67e5\u8bf7\u6c42\u4f53\u662f\u5426\u5305\u542b\u6240\u6709\u5fc5\u9700\u5b57\u6bb5',
\n 'INVALID_EMAIL': '\u4f7f\u7528\u6709\u6548\u7684\u90ae\u7bb1\u683c\u5f0f: user@example.com',
\n 'VALUE_TOO_SHORT': '\u589e\u52a0\u5b57\u6bb5\u503c\u7684\u957f\u5ea6',
\n 'VALUE_TOO_LONG': '\u51cf\u5c11\u5b57\u6bb5\u503c\u7684\u957f\u5ea6'
\n };<\/p>\n
return suggestions[detail.code] ||
\n `\u68c0\u67e5${detail.field}\u5b57\u6bb5\u7684\u503c\u662f\u5426\u7b26\u5408\u8981\u6c42`;
\n }<\/p>\n
displayAnalysis(analysis) {
\n \/\/ \u5728\u5f00\u53d1\u8005\u5de5\u5177\u4e2d\u663e\u793a\u5206\u6790\u7ed3\u679c
\n const panel = document.createElement('div');
\n panel.className = 'request-diagnostic-panel';<\/p>\n
panel.innerHTML = `
\n <h3>🔍 400\u9519\u8bef\u8bca\u65ad\u62a5\u544a<\/h3>
\n <div class="request-info">
\n <strong>${analysis.method}<\/strong> ${analysis.url}<br>
\n <small>\u8017\u65f6: ${analysis.duration}ms<\/small>
\n <\/div>
\n <div class="issues">
\n ${analysis.issues.map(issue => `
\n <div class="issue ${issue.type.toLowerCase()}">
\n <span class="issue-type">${issue.type}<\/span>
\n <strong>${issue.field}:<\/strong> ${issue.message}
\n <div class="suggestion">💡 ${issue.suggestion}<\/div>
\n <\/div>
\n `).join('')}
\n <\/div>
\n `;<\/p>\n
\/\/ \u6dfb\u52a0\u5230\u9875\u9762（\u5b9e\u9645\u5f00\u53d1\u4e2d\u5e94\u6dfb\u52a0\u5230\u5f00\u53d1\u8005\u5de5\u5177\u9762\u677f）
\n document.body.appendChild(panel);
\n }
\n}<\/p>\n
python<\/p>\n
# \u5b89\u5168\u914d\u7f6e：\u9519\u8bef\u4fe1\u606f\u6cc4\u9732\u9632\u62a4
\nclass SecureErrorHandler:
\n def __init__(self, debug_mode=False):
\n self.debug_mode = debug_mode
\n self.sensitive_patterns = [
\n r'password',
\n r'secret',
\n r'key',
\n r'token',
\n r'credit.*card',
\n r'ssn',
\n r'api[_-]?key'
\n ]<\/p>\n
def sanitize_error_detail(self, error_detail: Dict) -> Dict:
\n """\u6e05\u7406\u53ef\u80fd\u5305\u542b\u654f\u611f\u4fe1\u606f\u7684\u9519\u8bef\u8be6\u60c5"""
\n sanitized = error_detail.copy()<\/p>\n
# \u6e05\u7406\u5b57\u6bb5\u503c
\n if 'field' in sanitized and self.is_sensitive_field(sanitized['field']):
\n sanitized['value'] = '[REDACTED]'
\n sanitized['message'] = sanitized['message'].replace(
\n sanitized.get('actual_value', ''),
\n '[REDACTED]'
\n )<\/p>\n
# \u5728\u975e\u8c03\u8bd5\u6a21\u5f0f\u4e0b\u9690\u85cf\u6280\u672f\u7ec6\u8282
\n if not self.debug_mode:
\n sanitized.pop('stack_trace', None)
\n sanitized.pop('internal_code', None)
\n if 'message' in sanitized:
\n # \u901a\u7528\u5316\u9519\u8bef\u6d88\u606f
\n sanitized['message'] = self.generalize_message(
\n sanitized['message']
\n )<\/p>\n
return sanitized<\/p>\n
def is_sensitive_field(self, field_name: str) -> bool:
\n """\u68c0\u67e5\u5b57\u6bb5\u540d\u662f\u5426\u53ef\u80fd\u5305\u542b\u654f\u611f\u4fe1\u606f"""
\n field_lower = field_name.lower()
\n return any(
\n re.search(pattern, field_lower)
\n for pattern in self.sensitive_patterns
\n )<\/p>\n
def generalize_message(self, message: str) -> str:
\n """\u901a\u7528\u5316\u9519\u8bef\u6d88\u606f，\u907f\u514d\u6cc4\u9732\u5b9e\u73b0\u7ec6\u8282"""
\n generalizations = {
\n r'column ".*" does not exist': '\u8bf7\u6c42\u7684\u5b57\u6bb5\u4e0d\u5b58\u5728',
\n r'invalid input syntax': '\u8f93\u5165\u683c\u5f0f\u4e0d\u6b63\u786e',
\n r'division by zero': '\u8ba1\u7b97\u9519\u8bef',
\n r'cannot cast.*to.*': '\u7c7b\u578b\u8f6c\u6362\u9519\u8bef',
\n r'permission denied': '\u64cd\u4f5c\u88ab\u62d2\u7edd'
\n }<\/p>\n
for pattern, replacement in generalizations.items():
\n if re.search(pattern, message, re.IGNORECASE):
\n return replacement<\/p>\n
return '\u8bf7\u6c42\u5904\u7406\u5931\u8d25'<\/p>\n
python<\/p>\n
# \u9632\u6b62DoS\u653b\u51fb：\u8bf7\u6c42\u5927\u5c0f\u9650\u5236
\nfrom flask import request, abort
\nfrom functools import wraps
\nimport sys<\/p>\n
class RequestSizeLimiter:
\n def __init__(self, max_size=1024 * 1024): # 1MB\u9ed8\u8ba4
\n self.max_size = max_size<\/p>\n
def __call__(self, f):
\n @wraps(f)
\n def decorated_function(*args, **kwargs):
\n # \u68c0\u67e5Content-Length\u5934
\n content_length = request.content_length<\/p>\n
if content_length and content_length > self.max_size:
\n return {
\n 'error': {
\n 'code': 'REQUEST_TOO_LARGE',
\n 'message': f'\u8bf7\u6c42\u4f53\u5927\u5c0f\u8d85\u8fc7\u9650\u5236({self.max_size}\u5b57\u8282)',
\n 'max_size': self.max_size,
\n 'actual_size': content_length
\n }
\n }, 400<\/p>\n
# \u5bf9\u4e8e\u6d41\u5f0f\u8bf7\u6c42，\u68c0\u67e5\u5df2\u8bfb\u53d6\u7684\u6570\u636e
\n if request.is_streamed:
\n # \u8fd9\u91cc\u53ef\u4ee5\u5b9e\u73b0\u6d41\u5f0f\u8bfb\u53d6\u65f6\u7684\u68c0\u67e5
\n pass<\/p>\n
return f(*args, **kwargs)
\n return decorated_function<\/p>\n
# \u4f7f\u7528\u793a\u4f8b
\napp.config['MAX_CONTENT_LENGTH'] = 16 * 1024 * 1024 # 16MB\u5168\u5c40\u9650\u5236<\/p>\n
@app.route('\/upload', methods=['POST'])
\n@RequestSizeLimiter(max_size=10 * 1024 * 1024) # 10MB\u7aef\u70b9\u9650\u5236
\ndef upload_file():
\n # \u5904\u7406\u4e0a\u4f20
\n pass<\/p>\n
python<\/p>\n
# \u8bf7\u6c42\u5904\u7406\u7ba1\u9053：\u65e9\u671f\u9a8c\u8bc1
\nclass RequestPipeline:
\n def __init__(self):
\n self.validators = []<\/p>\n
def add_validator(self, validator):
\n self.validators.append(validator)<\/p>\n
async def process_request(self, request):
\n """\u6309\u987a\u5e8f\u6267\u884c\u9a8c\u8bc1，\u5feb\u901f\u5931\u8d25"""
\n validation_context = {
\n 'request': request,
\n 'errors': []
\n }<\/p>\n
# 1. \u57fa\u7840\u7ed3\u6784\u9a8c\u8bc1
\n yield self.validate_structure(request)<\/p>\n
# 2. \u8ba4\u8bc1\u9a8c\u8bc1（\u5982\u679c\u9002\u7528）
\n if self.requires_auth(request):
\n yield self.validate_auth(request)<\/p>\n
# 3. \u4e1a\u52a1\u89c4\u5219\u9a8c\u8bc1
\n yield self.validate_business_rules(request)<\/p>\n
# \u5982\u679c\u6709\u9519\u8bef，\u7acb\u5373\u8fd4\u56de400
\n if validation_context['errors']:
\n return self.create_error_response(validation_context['errors'])<\/p>\n
# 4. \u5904\u7406\u8bf7\u6c42
\n return await self.handle_request(request)<\/p>\n
def validate_structure(self, request):
\n """\u9a8c\u8bc1\u8bf7\u6c42\u57fa\u7840\u7ed3\u6784"""
\n errors = []<\/p>\n
# \u68c0\u67e5HTTP\u65b9\u6cd5
\n if request.method not in self.allowed_methods:
\n errors.append({
\n 'code': 'METHOD_NOT_ALLOWED',
\n 'message': f'\u4e0d\u652f\u6301\u7684\u65b9\u6cd5: {request.method}'
\n })<\/p>\n
# \u68c0\u67e5Content-Type
\n content_type = request.headers.get('Content-Type', '')
\n if request.method in ['POST', 'PUT', 'PATCH']:
\n if not content_type:
\n errors.append({
\n 'code': 'MISSING_CONTENT_TYPE',
\n 'message': 'Content-Type\u5934\u5fc5\u987b\u63d0\u4f9b'
\n })
\n elif 'application\/json' not in content_type:
\n errors.append({
\n 'code': 'UNSUPPORTED_MEDIA_TYPE',
\n 'message': '\u4ec5\u652f\u6301application\/json\u683c\u5f0f'
\n })<\/p>\n
return errors<\/p>\n
json<\/p>\n
{
\n "error": {
\n "code": "PARTIAL_FAILURE",
\n "message": "\u6279\u91cf\u8bf7\u6c42\u4e2d\u90e8\u5206\u64cd\u4f5c\u5931\u8d25",
\n "details": {
\n "successful": [1, 2, 4],
\n "failed": [
\n {
\n "index": 3,
\n "error": {
\n "code": "VALIDATION_ERROR",
\n "field": "email",
\n "message": "\u90ae\u7bb1\u683c\u5f0f\u65e0\u6548"
\n }
\n },
\n {
\n "index": 5,
\n "error": {
\n "code": "DUPLICATE_ENTRY",
\n "field": "username",
\n "message": "\u7528\u6237\u540d\u5df2\u5b58\u5728"
\n }
\n }
\n ]
\n }
\n }
\n}<\/p>\n
python<\/p>\n
# API\u7248\u672c\u5904\u7406
\nclass VersionedAPI:
\n def __init__(self):
\n self.supported_versions = ['v1', 'v2', 'v3']
\n self.default_version = 'v2'<\/p>\n
def validate_version(self, request):
\n """\u9a8c\u8bc1API\u7248\u672c"""
\n version = request.headers.get('X-API-Version') or \\\\
\n request.args.get('api_version')<\/p>\n
if not version:
\n version = self.default_version<\/p>\n
if version not in self.supported_versions:
\n return {
\n 'error': {
\n 'code': 'UNSUPPORTED_VERSION',
\n 'message': f'\u4e0d\u652f\u6301\u7684API\u7248\u672c: {version}',
\n 'supported_versions': self.supported_versions,
\n 'default_version': self.default_version
\n }
\n }, 400<\/p>\n
request.api_version = version
\n return None<\/p>\n
\u7531\u4e8e\u7bc7\u5e45\u9650\u5236，\u4ee5\u4e0a\u8be6\u7ec6\u5c55\u5f00\u4e86\u7b2c16\u7ae0"400 Bad Request"\u7684\u5185\u5bb9\u3002\u6bcf\u4e2a4xx\u72b6\u6001\u7801\u90fd\u9700\u8981\u7c7b\u4f3c\u7684\u6df1\u5ea6\u5206\u6790\u3002\u5982\u679c\u60a8\u9700\u8981\u5176\u4ed6\u7ae0\u8282（401\u3001403\u3001404\u7b49）\u7684\u8be6\u7ec6\u5185\u5bb9，\u6211\u53ef\u4ee5\u7ee7\u7eed\u4e3a\u60a8\u5c55\u5f00\u3002\u6bcf\u4e2a\u7ae0\u8282\u90fd\u4f1a\u6309\u7167\u7c7b\u4f3c\u7684\u6df1\u5ea6\u548c\u7ed3\u6784\u8fdb\u884c\u5206\u6790，\u5305\u62ec：<\/p>\n
\u5b9a\u4e49\u4e0e\u8bed\u4e49：\u72b6\u6001\u7801\u7684\u6b63\u5f0f\u5b9a\u4e49\u548c\u4f7f\u7528\u573a\u666f<\/p>\n<\/li>\n
\u89e6\u53d1\u6761\u4ef6：\u4ec0\u4e48\u60c5\u51b5\u4e0b\u5e94\u8be5\u8fd4\u56de\u8be5\u72b6\u6001\u7801<\/p>\n<\/li>\n
\u5b9e\u73b0\u7ec6\u8282：\u670d\u52a1\u5668\u7aef\u5982\u4f55\u6b63\u786e\u5b9e\u73b0<\/p>\n<\/li>\n
\u5ba2\u6237\u7aef\u5904\u7406：\u5ba2\u6237\u7aef\u5982\u4f55\u6b63\u786e\u5904\u7406\u54cd\u5e94<\/p>\n<\/li>\n
\u5b89\u5168\u8003\u8651：\u76f8\u5173\u7684\u5b89\u5168\u95ee\u9898\u548c\u9632\u62a4\u63aa\u65bd<\/p>\n<\/li>\n
\u6027\u80fd\u4f18\u5316：\u5982\u4f55\u9ad8\u6548\u5904\u7406\u8fd9\u7c7b\u9519\u8bef<\/p>\n<\/li>\n
\u76d1\u63a7\u8c03\u8bd5：\u5982\u4f55\u76d1\u63a7\u548c\u8c03\u8bd5\u76f8\u5173\u95ee\u9898<\/p>\n<\/li>\n
\u6700\u4f73\u5b9e\u8df5：\u884c\u4e1a\u5185\u7684\u6700\u4f73\u5b9e\u8df5\u548c\u6a21\u5f0f<\/p>\n<\/li>\n
\u60a8\u5e0c\u671b\u6211\u7ee7\u7eed\u5c55\u5f00\u54ea\u4e2a\u7ae0\u8282\u7684\u5185\u5bb9？<\/p>\n
\u7ee7\u7eed<\/p>\n
\u6211\u4eec\u7ee7\u7eed\u7b2c17\u7ae0：401 Unauthorized – \u8ba4\u8bc1\u5931\u8d25\u5904\u7406\u3002<\/p>\n
401 Unauthorized\u00a0\u72b6\u6001\u7801\u8868\u793a\u8bf7\u6c42\u7f3a\u5c11\u6709\u6548\u7684\u8eab\u4efd\u9a8c\u8bc1\u51ed\u8bc1，\u6216\u8005\u63d0\u4f9b\u7684\u51ed\u8bc1\u65e0\u6548\u3002\u8fd9\u4e2a\u72b6\u6001\u7801\u660e\u786e\u8868\u793a\u5ba2\u6237\u7aef\u9700\u8981\u63d0\u4f9b\u6709\u6548\u7684\u8eab\u4efd\u9a8c\u8bc1\u4fe1\u606f\u624d\u80fd\u8bbf\u95ee\u8d44\u6e90\u3002<\/p>\n
\u5173\u952e\u7279\u6027：<\/p>\n
\u4e0e\u8eab\u4efd\u9a8c\u8bc1（Authentication）\u76f8\u5173，\u5373\u201c\u4f60\u662f\u8c01\u201d\u7684\u95ee\u9898<\/p>\n<\/li>\n
\u901a\u5e38\u4e0eWWW-Authenticate\u54cd\u5e94\u5934\u4e00\u8d77\u4f7f\u7528，\u6307\u793a\u5982\u4f55\u63d0\u4f9b\u51ed\u8bc1<\/p>\n<\/li>\n
\u5ba2\u6237\u7aef\u53ef\u4ee5\u901a\u8fc7\u63d0\u4f9b\u6b63\u786e\u7684\u51ed\u8bc1\u91cd\u8bd5\u8bf7\u6c42<\/p>\n<\/li>\n<\/ul>\n
\u6ce8\u610f：401\u72b6\u6001\u7801\u4e0e403 Forbidden（\u7b2c18\u7ae0）\u7684\u533a\u522b\u5728\u4e8e，401\u8868\u793a\u672a\u8ba4\u8bc1\u6216\u8ba4\u8bc1\u5931\u8d25，\u800c403\u8868\u793a\u5df2\u8ba4\u8bc1\u4f46\u65e0\u6743\u8bbf\u95ee\u3002<\/p>\n
http<\/p>\n
GET \/api\/protected-resource HTTP\/1.1
\nHost: example.com
\n# \u672a\u63d0\u4f9bAuthorization\u5934<\/p>\n
http<\/p>\n
GET \/api\/protected-resource HTTP\/1.1
\nHost: example.com
\nAuthorization: Bearer invalid_or_expired_token<\/p>\n
http<\/p>\n
GET \/api\/protected-resource HTTP\/1.1
\nHost: example.com
\nAuthorization: Bearer token_with_incorrect_format<\/p>\n
http<\/p>\n
GET \/api\/protected-resource HTTP\/1.1
\nHost: example.com
\nAuthorization: Basic dXNlcjpwYXNz # \u53ef\u80fd\u7aef\u70b9\u671f\u671bBearer\u4ee4\u724c<\/p>\n
\u6839\u636eHTTP\u6807\u51c6，\u5f53\u8fd4\u56de401\u72b6\u6001\u7801\u65f6，\u670d\u52a1\u5668\u5e94\u8be5\u5305\u542bWWW-Authenticate\u5934，\u6307\u793a\u5ba2\u6237\u7aef\u5982\u4f55\u63d0\u4f9b\u51ed\u8bc1\u3002<\/p>\n
http<\/p>\n
HTTP\/1.1 401 Unauthorized
\nWWW-Authenticate: Bearer realm="example", error="invalid_token", error_description="The access token expired"
\nContent-Type: application\/json<\/p>\n
{
\n "error": "invalid_token",
\n "error_description": "The access token expired"
\n}<\/p>\n
\u5e38\u89c1\u7684\u8ba4\u8bc1\u65b9\u6848（Authentication Schemes）：<\/p>\n
Basic: \u4f7f\u7528Base64\u7f16\u7801\u7684\u7528\u6237\u540d\u548c\u5bc6\u7801<\/p>\n<\/li>\n
Bearer: \u4f7f\u7528Bearer\u4ee4\u724c（\u5982OAuth 2.0）<\/p>\n<\/li>\n
Digest: \u4f7f\u7528\u6458\u8981\u8ba4\u8bc1<\/p>\n<\/li>\n
Negotiate: \u4f7f\u7528SPNEGO（\u4f8b\u5982Kerberos）<\/p>\n<\/li>\n<\/ul>\n
python<\/p>\n
# Python\u793a\u4f8b：JWT\u8ba4\u8bc1\u4e2d\u95f4\u4ef6
\nimport jwt
\nfrom functools import wraps
\nfrom flask import request, jsonify, current_app<\/p>\n
def token_required(f):
\n @wraps(f)
\n def decorated(*args, **kwargs):
\n auth_header = request.headers.get('Authorization')<\/p>\n
if not auth_header:
\n # \u8fd4\u56de401，\u6307\u793a\u9700\u8981\u63d0\u4f9bBearer\u4ee4\u724c
\n response = jsonify({
\n 'error': 'authentication_required',
\n 'error_description': 'Authorization header is missing'
\n })
\n response.status_code = 401
\n response.headers['WWW-Authenticate'] = 'Bearer realm="Protected Resource"'
\n return response<\/p>\n
# \u68c0\u67e5Authorization\u5934\u7684\u683c\u5f0f
\n parts = auth_header.split()<\/p>\n
if parts[0].lower() != 'bearer':
\n response = jsonify({
\n 'error': 'invalid_header',
\n 'error_description': 'Authorization header must start with Bearer'
\n })
\n response.status_code = 401
\n response.headers['WWW-Authenticate'] = 'Bearer realm="Protected Resource", error="invalid_header"'
\n return response<\/p>\n
if len(parts) == 1:
\n response = jsonify({
\n 'error': 'invalid_header',
\n 'error_description': 'Token not found'
\n })
\n response.status_code = 401
\n response.headers['WWW-Authenticate'] = 'Bearer realm="Protected Resource", error="invalid_header"'
\n return response<\/p>\n
if len(parts) > 2:
\n response = jsonify({
\n 'error': 'invalid_header',
\n 'error_description': 'Authorization header must be Bearer token'
\n })
\n response.status_code = 401
\n response.headers['WWW-Authenticate'] = 'Bearer realm="Protected Resource", error="invalid_header"'
\n return response<\/p>\n
token = parts[1]<\/p>\n
try:
\n # \u89e3\u7801\u4ee4\u724c
\n payload = jwt.decode(
\n token,
\n current_app.config['SECRET_KEY'],
\n algorithms=['HS256']
\n )
\n request.user_id = payload['sub']
\n except jwt.ExpiredSignatureError:
\n response = jsonify({
\n 'error': 'token_expired',
\n 'error_description': 'The access token has expired'
\n })
\n response.status_code = 401
\n response.headers['WWW-Authenticate'] = 'Bearer realm="Protected Resource", error="invalid_token", error_description="The access token expired"'
\n return response
\n except jwt.InvalidTokenError as e:
\n response = jsonify({
\n 'error': 'invalid_token',
\n 'error_description': str(e)
\n })
\n response.status_code = 401
\n response.headers['WWW-Authenticate'] = 'Bearer realm="Protected Resource", error="invalid_token"'
\n return response<\/p>\n
return f(*args, **kwargs)<\/p>\n
return decorated<\/p>\n
# \u4f7f\u7528\u793a\u4f8b
\n@app.route('\/api\/protected')
\n@token_required
\ndef protected_resource():
\n return jsonify({'message': 'This is a protected resource'})<\/p>\n
\u5f53\u7aef\u70b9\u9700\u8981\u591a\u56e0\u7d20\u8ba4\u8bc1\u65f6，\u53ef\u4ee5\u4f7f\u7528\u81ea\u5b9a\u4e49\u9519\u8bef\u4ee3\u7801\u6765\u6307\u793a\u9700\u8981\u989d\u5916\u7684\u9a8c\u8bc1\u6b65\u9aa4\u3002<\/p>\n
http<\/p>\n
HTTP\/1.1 401 Unauthorized
\nContent-Type: application\/json<\/p>\n
{
\n "error": "mfa_required",
\n "error_description": "Multi-factor authentication is required",
\n "mfa_methods": ["totp", "sms"],
\n "mfa_token": "temp_token_for_mfa"
\n}<\/p>\n
\u5ba2\u6237\u7aef\u968f\u540e\u53ef\u4ee5\u4f7f\u7528mfa_token\u548c\u63d0\u4f9b\u7684\u9a8c\u8bc1\u7801\u8c03\u7528MFA\u9a8c\u8bc1\u7aef\u70b9\u3002<\/p>\n
javascript<\/p>\n
\/\/ \u5ba2\u6237\u7aef：\u81ea\u52a8\u5237\u65b0\u8bbf\u95ee\u4ee4\u724c
\nclass AuthClient {
\n constructor() {
\n this.accessToken = localStorage.getItem('access_token');
\n this.refreshToken = localStorage.getItem('refresh_token');
\n this.isRefreshing = false;
\n this.refreshSubscribers = [];
\n }<\/p>\n
async request(url, options = {}) {
\n \/\/ \u521d\u59cb\u8bf7\u6c42
\n let response = await this.makeRequest(url, options);<\/p>\n
\/\/ \u5982\u679c\u8fd4\u56de401，\u5c1d\u8bd5\u5237\u65b0\u4ee4\u724c\u5e76\u91cd\u8bd5
\n if (response.status === 401) {
\n const errorData = await response.json();<\/p>\n
\/\/ \u68c0\u67e5\u9519\u8bef\u7c7b\u578b，\u53ea\u6709\u7279\u5b9a\u7684\u4ee4\u724c\u9519\u8bef\u624d\u5c1d\u8bd5\u5237\u65b0
\n if (errorData.error === 'token_expired' || errorData.error === 'invalid_token') {
\n \/\/ \u5237\u65b0\u4ee4\u724c
\n const newToken = await this.refreshAccessToken();<\/p>\n
if (newToken) {
\n \/\/ \u4f7f\u7528\u65b0\u4ee4\u724c\u91cd\u8bd5\u8bf7\u6c42
\n options.headers.Authorization = `Bearer ${newToken}`;
\n response = await this.makeRequest(url, options);
\n } else {
\n \/\/ \u5237\u65b0\u5931\u8d25，\u8df3\u8f6c\u5230\u767b\u5f55\u9875
\n this.redirectToLogin();
\n }
\n } else if (errorData.error === 'authentication_required') {
\n \/\/ \u9700\u8981\u91cd\u65b0\u767b\u5f55
\n this.redirectToLogin();
\n }
\n }<\/p>\n
return response;
\n }<\/p>\n
async makeRequest(url, options) {
\n const defaultHeaders = {
\n 'Authorization': `Bearer ${this.accessToken}`,
\n 'Content-Type': 'application\/json'
\n };<\/p>\n
const mergedOptions = {
\n …options,
\n headers: {
\n …defaultHeaders,
\n …options.headers
\n }
\n };<\/p>\n
return fetch(url, mergedOptions);
\n }<\/p>\n
async refreshAccessToken() {
\n \/\/ \u9632\u6b62\u5e76\u53d1\u5237\u65b0
\n if (this.isRefreshing) {
\n \/\/ \u5982\u679c\u5df2\u7ecf\u5728\u5237\u65b0，\u5219\u7b49\u5f85\u5237\u65b0\u5b8c\u6210
\n return new Promise((resolve) => {
\n this.refreshSubscribers.push(resolve);
\n });
\n }<\/p>\n
this.isRefreshing = true;<\/p>\n
try {
\n const response = await fetch('\/auth\/refresh', {
\n method: 'POST',
\n headers: {
\n 'Content-Type': 'application\/json'
\n },
\n body: JSON.stringify({
\n refresh_token: this.refreshToken
\n })
\n });<\/p>\n
if (response.ok) {
\n const data = await response.json();
\n this.accessToken = data.access_token;<\/p>\n
\/\/ \u5b58\u50a8\u65b0\u4ee4\u724c
\n localStorage.setItem('access_token', data.access_token);<\/p>\n
\/\/ \u901a\u77e5\u6240\u6709\u7b49\u5f85\u7684\u8bf7\u6c42
\n this.refreshSubscribers.forEach(callback => callback(data.access_token));
\n this.refreshSubscribers = [];<\/p>\n
return data.access_token;
\n } else {
\n \/\/ \u5237\u65b0\u5931\u8d25，\u6e05\u9664\u672c\u5730\u5b58\u50a8
\n this.clearTokens();
\n return null;
\n }
\n } catch (error) {
\n console.error('Failed to refresh token:', error);
\n return null;
\n } finally {
\n this.isRefreshing = false;
\n }
\n }<\/p>\n
clearTokens() {
\n localStorage.removeItem('access_token');
\n localStorage.removeItem('refresh_token');
\n this.accessToken = null;
\n this.refreshToken = null;
\n }<\/p>\n
redirectToLogin() {
\n window.location.href = '\/login?return=' + encodeURIComponent(window.location.pathname);
\n }
\n}<\/p>\n
javascript<\/p>\n
\/\/ \u5904\u7406\u591a\u4e2aWWW-Authenticate\u8d28\u8be2
\nfunction parseWwwAuthenticate(header) {
\n const challenges = [];<\/p>\n
\/\/ \u53ef\u80fd\u6709\u591a\u4e2a\u8d28\u8be2，\u7528\u9017\u53f7\u5206\u9694（\u6ce8\u610f：\u4e00\u4e2a\u5934\u5185\u53ef\u80fd\u6709\u591a\u4e2a\u65b9\u6848，\u4f46\u901a\u5e38\u6bcf\u4e2a\u65b9\u6848\u5355\u72ec\u4e00\u4e2a\u5934）
\n \/\/ \u5b9e\u9645\u4e2d，\u670d\u52a1\u5668\u53ef\u80fd\u8fd4\u56de\u591a\u4e2aWWW-Authenticate\u5934，\u6bcf\u4e2a\u5bf9\u5e94\u4e00\u4e2a\u65b9\u6848
\n const schemes = header.split(',').map(s => s.trim());<\/p>\n
schemes.forEach(scheme => {
\n const [schemeName, …params] = scheme.split(' ');
\n const challenge = {
\n scheme: schemeName.toLowerCase(),
\n parameters: {}
\n };<\/p>\n
\/\/ \u89e3\u6790\u53c2\u6570（\u5982realm, error, error_description\u7b49）
\n params.join(' ').split(',').forEach(param => {
\n const [key, value] = param.trim().split('=');
\n if (key && value) {
\n \/\/ \u53bb\u9664\u503c\u7684\u5f15\u53f7
\n challenge.parameters[key] = value.replace(\/^"(.*)"$\/, '$1');
\n }
\n });<\/p>\n
challenges.push(challenge);
\n });<\/p>\n
return challenges;
\n}<\/p>\n
\/\/ \u6839\u636e\u8d28\u8be2\u9009\u62e9\u5408\u9002\u7684\u8ba4\u8bc1\u65b9\u6cd5
\nasync function handleAuthenticationChallenge(challenges) {
\n \/\/ \u4f18\u5148\u9009\u62e9\u652f\u6301\u7684\u65b9\u6848
\n const supportedSchemes = ['bearer', 'basic'];<\/p>\n
for (const scheme of supportedSchemes) {
\n const challenge = challenges.find(c => c.scheme === scheme);
\n if (challenge) {
\n switch (scheme) {
\n case 'bearer':
\n \/\/ \u5bf9\u4e8eBearer，\u6211\u4eec\u901a\u5e38\u5df2\u7ecf\u6709\u4ee4\u724c，\u6240\u4ee5\u53ef\u80fd\u662f\u4ee4\u724c\u8fc7\u671f，\u9700\u8981\u5237\u65b0
\n \/\/ \u6216\u8005\u9700\u8981\u83b7\u53d6\u65b0\u7684\u4ee4\u724c
\n return await refreshBearerToken();
\n case 'basic':
\n \/\/ \u57fa\u672c\u8ba4\u8bc1，\u9700\u8981\u7528\u6237\u540d\u548c\u5bc6\u7801
\n return await promptForCredentials();
\n default:
\n continue;
\n }
\n }
\n }<\/p>\n
\/\/ \u6ca1\u6709\u652f\u6301\u7684\u65b9\u6848，\u629b\u51fa\u9519\u8bef
\n throw new Error('No supported authentication scheme found');
\n}<\/p>\n
python<\/p>\n
# \u9650\u5236\u8ba4\u8bc1\u5c1d\u8bd5\u6b21\u6570
\nimport time
\nfrom collections import defaultdict<\/p>\n
class AuthenticationLimiter:
\n def __init__(self, max_attempts=5, lockout_time=300):
\n self.max_attempts = max_attempts
\n self.lockout_time = lockout_time
\n self.attempts = defaultdict(list)<\/p>\n
def is_locked_out(self, identifier):
\n """\u68c0\u67e5\u662f\u5426\u56e0\u591a\u6b21\u5931\u8d25\u88ab\u9501\u5b9a"""
\n now = time.time()<\/p>\n
# \u6e05\u7406\u8fc7\u671f\u7684\u5c1d\u8bd5\u8bb0\u5f55
\n self.attempts[identifier] = [
\n attempt_time for attempt_time in self.attempts[identifier]
\n if now – attempt_time < self.lockout_time
\n ]<\/p>\n
# \u68c0\u67e5\u5c1d\u8bd5\u6b21\u6570
\n return len(self.attempts[identifier]) >= self.max_attempts<\/p>\n
def record_failure(self, identifier):
\n """\u8bb0\u5f55\u4e00\u6b21\u5931\u8d25\u5c1d\u8bd5"""
\n self.attempts[identifier].append(time.time())<\/p>\n
def record_success(self, identifier):
\n """\u6210\u529f\u8ba4\u8bc1\u540e\u6e05\u9664\u5931\u8d25\u8bb0\u5f55"""
\n if identifier in self.attempts:
\n del self.attempts[identifier]<\/p>\n
# \u5728\u8ba4\u8bc1\u7aef\u70b9\u4e2d\u4f7f\u7528
\nlimiter = AuthenticationLimiter()<\/p>\n
@app.route('\/auth\/login', methods=['POST'])
\ndef login():
\n data = request.get_json()
\n username = data.get('username')<\/p>\n
# \u68c0\u67e5\u662f\u5426\u88ab\u9501\u5b9a
\n if limiter.is_locked_out(username):
\n return jsonify({
\n 'error': 'account_locked',
\n 'error_description': 'Too many failed attempts. Please try again later.'
\n }), 401<\/p>\n
# \u9a8c\u8bc1\u51ed\u8bc1
\n if validate_credentials(username, data.get('password')):
\n limiter.record_success(username)
\n return jsonify({'access_token': create_token(username)})
\n else:
\n limiter.record_failure(username)<\/p>\n
# \u8fd4\u56de\u901a\u7528\u9519\u8bef\u6d88\u606f，\u907f\u514d\u4fe1\u606f\u6cc4\u9732
\n return jsonify({
\n 'error': 'authentication_failed',
\n 'error_description': 'Invalid username or password'
\n }), 401<\/p>\n
javascript<\/p>\n
\/\/ \u5ba2\u6237\u7aef\u5b89\u5168\u5b58\u50a8\u4ee4\u724c
\nclass SecureTokenStorage {
\n constructor() {
\n this.useLocalStorage = this.testLocalStorage();
\n this.memoryStorage = new Map();
\n }<\/p>\n
testLocalStorage() {
\n try {
\n localStorage.setItem('test', 'test');
\n localStorage.removeItem('test');
\n return true;
\n } catch (e) {
\n return false;
\n }
\n }<\/p>\n
setItem(key, value) {
\n if (this.useLocalStorage) {
\n localStorage.setItem(key, value);
\n } else {
\n this.memoryStorage.set(key, value);
\n }
\n }<\/p>\n
getItem(key) {
\n if (this.useLocalStorage) {
\n return localStorage.getItem(key);
\n } else {
\n return this.memoryStorage.get(key);
\n }
\n }<\/p>\n
removeItem(key) {
\n if (this.useLocalStorage) {
\n localStorage.removeItem(key);
\n } else {
\n this.memoryStorage.delete(key);
\n }
\n }<\/p>\n
\/\/ \u5bf9\u4e8e\u654f\u611f\u4ee4\u724c，\u8003\u8651\u4f7f\u7528sessionStorage\u6216\u52a0\u5bc6\u5b58\u50a8
\n storeAccessToken(token) {
\n \/\/ \u4f7f\u7528sessionStorage，\u5173\u95ed\u6d4f\u89c8\u5668\u540e\u6e05\u9664
\n sessionStorage.setItem('access_token', token);
\n }<\/p>\n
storeRefreshToken(token) {
\n \/\/ \u5237\u65b0\u4ee4\u724c\u53ef\u4ee5\u5b58\u50a8\u66f4\u4e45，\u4f46\u4e5f\u8981\u5b89\u5168
\n \/\/ \u8003\u8651\u4f7f\u7528HttpOnly cookie，\u4f46\u8fd9\u91cc\u6f14\u793a\u52a0\u5bc6\u5b58\u50a8
\n const encrypted = this.encrypt(token);
\n this.setItem('refresh_token', encrypted);
\n }<\/p>\n
encrypt(text) {
\n \/\/ \u7b80\u5355\u7684\u52a0\u5bc6\u793a\u4f8b，\u5b9e\u9645\u4e2d\u5e94\u4f7f\u7528\u66f4\u5b89\u5168\u7684\u52a0\u5bc6\u65b9\u6cd5
\n return btoa(text);
\n }<\/p>\n
decrypt(encrypted) {
\n return atob(encrypted);
\n }
\n}<\/p>\n
python<\/p>\n
import logging
\nfrom datetime import datetime<\/p>\n
class AuthAuditLogger:
\n def __init__(self):
\n self.logger = logging.getLogger('auth_audit')<\/p>\n
# \u914d\u7f6e\u6587\u4ef6\u5904\u7406\u5668
\n handler = logging.FileHandler('auth_audit.log')
\n handler.setFormatter(logging.Formatter(
\n '%(asctime)s – %(levelname)s – %(message)s'
\n ))
\n self.logger.addHandler(handler)
\n self.logger.setLevel(logging.INFO)<\/p>\n
def log_authentication_attempt(self, username, success, ip_address, user_agent, reason=None):
\n event = {
\n 'timestamp': datetime.utcnow().isoformat(),
\n 'event_type': 'authentication_attempt',
\n 'username': username,
\n 'success': success,
\n 'ip_address': ip_address,
\n 'user_agent': user_agent,
\n 'reason': reason
\n }<\/p>\n
self.logger.info('Authentication attempt: %s', event)<\/p>\n
def log_token_refresh(self, user_id, success, ip_address):
\n event = {
\n 'timestamp': datetime.utcnow().isoformat(),
\n 'event_type': 'token_refresh',
\n 'user_id': user_id,
\n 'success': success,
\n 'ip_address': ip_address
\n }<\/p>\n
self.logger.info('Token refresh: %s', event)<\/p>\n
def log_unauthorized_access(self, request_path, method, ip_address, user_agent):
\n event = {
\n 'timestamp': datetime.utcnow().isoformat(),
\n 'event_type': 'unauthorized_access',
\n 'request_path': request_path,
\n 'method': method,
\n 'ip_address': ip_address,
\n 'user_agent': user_agent
\n }<\/p>\n
self.logger.warning('Unauthorized access attempt: %s', event)<\/p>\n
# \u5728\u8ba4\u8bc1\u8fc7\u7a0b\u4e2d\u4f7f\u7528
\nauth_logger = AuthAuditLogger()<\/p>\n
@app.route('\/api\/protected')
\n@token_required
\ndef protected_resource():
\n # \u8bb0\u5f55\u6210\u529f\u8bbf\u95ee
\n auth_logger.log_authentication_attempt(
\n username=current_user.username,
\n success=True,
\n ip_address=request.remote_addr,
\n user_agent=request.headers.get('User-Agent')
\n )
\n return jsonify({'message': 'Protected resource'})<\/p>\n
python<\/p>\n
import hashlib
\nfrom functools import lru_cache<\/p>\n
class TokenValidator:
\n def __init__(self):
\n self.cache_enabled = True
\n self.cache = {}<\/p>\n
def get_cache_key(self, token):
\n """\u751f\u6210\u4ee4\u724c\u7684\u7f13\u5b58\u952e（\u4f7f\u7528\u54c8\u5e0c\u907f\u514d\u5b58\u50a8\u539f\u59cb\u4ee4\u724c）"""
\n return hashlib.sha256(token.encode()).hexdigest()<\/p>\n
@lru_cache(maxsize=1000)
\n def validate_token_cached(self, token_hash, current_time):
\n """\u7f13\u5b58\u9a8c\u8bc1\u7ed3\u679c，\u6ce8\u610f：current_time\u53c2\u6570\u7528\u4e8e\u4f7f\u7f13\u5b58\u8fc7\u671f"""
\n # \u6ce8\u610f：\u8fd9\u91cc\u4e0d\u80fd\u76f4\u63a5\u7f13\u5b58\u4ee4\u724c，\u56e0\u4e3a\u4ee4\u724c\u53ef\u80fd\u88ab\u64a4\u9500
\n # \u6240\u4ee5\u5b9e\u9645\u4e2d，\u7f13\u5b58\u65f6\u95f4\u5e94\u8be5\u5f88\u77ed，\u6216\u8005\u4f7f\u7528\u4ee4\u724c\u7684\u8fc7\u671f\u65f6\u95f4
\n pass<\/p>\n
def validate_token(self, token):
\n if not self.cache_enabled:
\n return self._validate_token(token)<\/p>\n
cache_key = self.get_cache_key(token)<\/p>\n
# \u68c0\u67e5\u7f13\u5b58
\n if cache_key in self.cache:
\n cached_result = self.cache[cache_key]
\n # \u68c0\u67e5\u7f13\u5b58\u662f\u5426\u8fc7\u671f（\u4f8b\u5982，\u7f13\u5b581\u5206\u949f）
\n if time.time() – cached_result['timestamp'] < 60:
\n return cached_result['result']<\/p>\n
# \u9a8c\u8bc1\u4ee4\u724c
\n result = self._validate_token(token)<\/p>\n
# \u7f13\u5b58\u7ed3\u679c
\n self.cache[cache_key] = {
\n 'result': result,
\n 'timestamp': time.time()
\n }<\/p>\n
return result<\/p>\n
python<\/p>\n
# \u6ed1\u52a8\u8fc7\u671f：\u6bcf\u6b21\u6709\u6548\u8bf7\u6c42\u540e\u66f4\u65b0\u4ee4\u724c\u8fc7\u671f\u65f6\u95f4
\nclass SlidingExpirationToken:
\n def __init__(self, initial_ttl=3600, max_ttl=86400):
\n self.initial_ttl = initial_ttl
\n self.max_ttl = max_ttl<\/p>\n
def create_token(self, user_id):
\n """\u521b\u5efa\u521d\u59cb\u4ee4\u724c"""
\n now = time.time()
\n payload = {
\n 'sub': user_id,
\n 'iat': now,
\n 'exp': now + self.initial_ttl,
\n 'max_exp': now + self.max_ttl # \u7edd\u5bf9\u8fc7\u671f\u65f6\u95f4
\n }
\n return jwt.encode(payload, SECRET_KEY, algorithm='HS256')<\/p>\n
def refresh_token_if_needed(self, token, threshold=300):
\n """
\n \u68c0\u67e5\u4ee4\u724c\u662f\u5426\u9700\u8981\u5237\u65b0（\u5728\u8fc7\u671f\u524dthreshold\u79d2）
\n \u5982\u679c\u9700\u8981，\u521b\u5efa\u65b0\u4ee4\u724c
\n """
\n try:
\n payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
\n current_time = time.time()<\/p>\n
# \u68c0\u67e5\u662f\u5426\u8d85\u8fc7\u6700\u5927\u8fc7\u671f\u65f6\u95f4
\n if current_time > payload['max_exp']:
\n return None, 'Token has reached maximum lifetime'<\/p>\n
# \u68c0\u67e5\u662f\u5426\u9700\u8981\u5237\u65b0
\n if payload['exp'] – current_time < threshold:
\n # \u521b\u5efa\u65b0\u4ee4\u724c，\u4fdd\u6301\u76f8\u540c\u7684max_exp
\n new_payload = {
\n 'sub': payload['sub'],
\n 'iat': current_time,
\n 'exp': current_time + self.initial_ttl,
\n 'max_exp': payload['max_exp']
\n }
\n new_token = jwt.encode(new_payload, SECRET_KEY, algorithm='HS256')
\n return new_token, 'Token refreshed'<\/p>\n
return token, 'Token still valid'
\n except jwt.ExpiredSignatureError:
\n return None, 'Token expired'
\n except jwt.InvalidTokenError as e:
\n return None, f'Invalid token: {str(e)}'<\/p>\n
# \u5728\u4e2d\u95f4\u4ef6\u4e2d\u4f7f\u7528
\n@app.route('\/api\/protected')
\n@token_required
\ndef protected_resource():
\n # \u83b7\u53d6\u5f53\u524d\u4ee4\u724c
\n auth_header = request.headers.get('Authorization')
\n token = auth_header.split()[1]<\/p>\n
# \u68c0\u67e5\u5e76\u5237\u65b0\u4ee4\u724c
\n new_token, message = token_manager.refresh_token_if_needed(token)<\/p>\n
if new_token and new_token != token:
\n # \u5728\u54cd\u5e94\u5934\u4e2d\u8fd4\u56de\u65b0\u4ee4\u724c
\n response = jsonify({'message': 'Protected resource'})
\n response.headers['X-New-Access-Token'] = new_token
\n return response<\/p>\n
return jsonify({'message': 'Protected resource'})<\/p>\n
403 Forbidden\u00a0\u72b6\u6001\u7801\u8868\u793a\u670d\u52a1\u5668\u7406\u89e3\u8bf7\u6c42，\u4f46\u62d2\u7edd\u6267\u884c\u3002\u4e0e401 Unauthorized\u4e0d\u540c，403\u72b6\u6001\u7801\u901a\u5e38\u7528\u4e8e\u5df2\u7ecf\u901a\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u7528\u6237，\u4f46\u5176\u6743\u9650\u4e0d\u8db3\u4ee5\u8bbf\u95ee\u7279\u5b9a\u8d44\u6e90\u3002<\/p>\n
\u5173\u952e\u7279\u6027：<\/p>\n
\u8bf7\u6c42\u5df2\u901a\u8fc7\u8eab\u4efd\u9a8c\u8bc1（\u6216\u4e0d\u9700\u8981\u8eab\u4efd\u9a8c\u8bc1）<\/p>\n<\/li>\n
\u670d\u52a1\u5668\u660e\u786e\u62d2\u7edd\u6267\u884c\u8bf7\u6c42<\/p>\n<\/li>\n
\u901a\u5e38\u4e0e\u8bbf\u95ee\u63a7\u5236（\u6388\u6743）\u76f8\u5173<\/p>\n<\/li>\n<\/ul>\n
\u5e38\u89c1\u573a\u666f：<\/p>\n
\u7528\u6237\u5c1d\u8bd5\u8bbf\u95ee\u672a\u6388\u6743\u8d44\u6e90<\/p>\n<\/li>\n
\u5c1d\u8bd5\u6267\u884c\u672a\u6388\u6743\u7684\u64cd\u4f5c<\/p>\n<\/li>\n
IP\u5730\u5740\u88ab\u7981\u6b62<\/p>\n<\/li>\n
\u8bf7\u6c42\u88ab\u5b89\u5168\u7b56\u7565\u963b\u6b62<\/p>\n<\/li>\n<\/ul>\n
| \u8eab\u4efd\u9a8c\u8bc1\u72b6\u6001<\/td>\n | \u672a\u901a\u8fc7\u8eab\u4efd\u9a8c\u8bc1<\/td>\n | \u5df2\u901a\u8fc7\u8eab\u4efd\u9a8c\u8bc1（\u6216\u4e0d\u9700\u8981）<\/td>\n<\/tr>\n |
| \u95ee\u9898\u6839\u6e90<\/td>\n | \u8eab\u4efd\u9a8c\u8bc1\u5931\u8d25\u6216\u7f3a\u5931<\/td>\n | \u6388\u6743\u5931\u8d25，\u6743\u9650\u4e0d\u8db3<\/td>\n<\/tr>\n |
| \u89e3\u51b3\u65b9\u6848<\/td>\n | \u63d0\u4f9b\u6709\u6548\u7684\u8eab\u4efd\u9a8c\u8bc1\u51ed\u8bc1<\/td>\n | \u63d0\u5347\u6743\u9650\u6216\u8bf7\u6c42\u5176\u4ed6\u8d44\u6e90<\/td>\n<\/tr>\n |
| \u54cd\u5e94\u5934<\/td>\n | \u901a\u5e38\u5305\u542bWWW-Authenticate<\/td>\n | \u901a\u5e38\u4e0d\u5305\u542bWWW-Authenticate<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n18.3 \u5e38\u89c1\u89e6\u53d1\u573a\u666f<\/h4>\n |