### \u4e00\u3001Cookie \u5728\u7528\u6237\u767b\u5f55\u7cfb\u7edf\u4e2d\u7684\u6838\u5fc3\u4f5c\u7528<\/p>\n
HTTP \u534f\u8bae\u672c\u8eab\u662f**\u65e0\u72b6\u6001**\u7684（\u670d\u52a1\u5668\u65e0\u6cd5\u8bb0\u4f4f\u4e24\u6b21\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u540c\u4e00\u4e2a\u7528\u6237），\u800c\u767b\u5f55\u7cfb\u7edf\u9700\u8981\u8bc6\u522b\u7528\u6237\u8eab\u4efd，Cookie \u6b63\u662f\u89e3\u51b3\u8fd9\u4e2a\u95ee\u9898\u7684\u6838\u5fc3\u624b\u6bb5，\u4e3b\u8981\u4f5c\u7528\u6709：<\/p>\n
1. **\u8eab\u4efd\u6807\u8bc6**：\u7528\u6237\u767b\u5f55\u6210\u529f\u540e，\u670d\u52a1\u5668\u751f\u6210\u552f\u4e00\u7684 `session_id`（\u5173\u8054\u7528\u6237\u4fe1\u606f，\u5b58\u50a8\u5728\u670d\u52a1\u5668\u7aef\u5982 Redis），\u5e76\u901a\u8fc7 `Set-Cookie` \u54cd\u5e94\u5934\u5c06 `session_id` \u53d1\u9001\u7ed9\u6d4f\u89c8\u5668，\u6d4f\u89c8\u5668\u5c06\u5176\u5b58\u50a8\u4e3a Cookie\u3002<\/p>\n
2. **\u72b6\u6001\u4fdd\u6301**：\u540e\u7eed\u7528\u6237\u8bbf\u95ee\u7cfb\u7edf\u7684\u4efb\u610f\u9875\u9762\u65f6，\u6d4f\u89c8\u5668\u4f1a\u81ea\u52a8\u5c06\u8be5 Cookie \u9644\u52a0\u5728\u8bf7\u6c42\u5934\u4e2d\u53d1\u9001\u7ed9\u670d\u52a1\u5668，\u670d\u52a1\u5668\u901a\u8fc7 `session_id` \u5c31\u80fd\u8bc6\u522b\u51fa\u7528\u6237\u8eab\u4efd，\u65e0\u9700\u91cd\u590d\u767b\u5f55\u3002<\/p>\n
3. **\u767b\u5f55\u6301\u4e45\u5316**：\u901a\u8fc7\u8bbe\u7f6e Cookie \u7684\u8fc7\u671f\u65f6\u95f4（\u5982\u201c\u8bb0\u4f4f\u6211\u201d\u529f\u80fd），\u8ba9 Cookie \u957f\u671f\u5b58\u50a8\u5728\u6d4f\u89c8\u5668\u4e2d，\u7528\u6237\u4e0b\u6b21\u6253\u5f00\u7f51\u7ad9\u65e0\u9700\u91cd\u65b0\u767b\u5f55\u3002<\/p>\n
\n
### \u4e8c\u3001\u767b\u5f55\u7cfb\u7edf\u4e2d Cookie \u7684\u5178\u578b\u7ba1\u7406\u6d41\u7a0b<\/p>\n
\u4ee5\u5e38\u89c1\u7684 Web \u767b\u5f55\u7cfb\u7edf\u4e3a\u4f8b，Cookie \u7684\u5b8c\u6574\u751f\u547d\u5468\u671f\u5982\u4e0b：<\/p>\n
```mermaid<\/p>\n
flowchart LR<\/p>\n
\u00a0\u00a0\u00a0 A[\u7528\u6237\u8f93\u5165\u8d26\u53f7\u5bc6\u7801\u63d0\u4ea4\u767b\u5f55\u8bf7\u6c42] –> B[\u670d\u52a1\u5668\u9a8c\u8bc1\u8d26\u53f7\u5bc6\u7801]<\/p>\n
\u00a0\u00a0\u00a0 B –>|\u9a8c\u8bc1\u5931\u8d25| C[\u8fd4\u56de\u767b\u5f55\u5931\u8d25\u63d0\u793a]<\/p>\n
\u00a0\u00a0\u00a0 B –>|\u9a8c\u8bc1\u6210\u529f| D[\u751f\u6210session_id，\u5173\u8054\u7528\u6237\u4fe1\u606f\u5b58\u50a8\u5728\u670d\u52a1\u5668]<\/p>\n
\u00a0\u00a0\u00a0 D –> E[\u670d\u52a1\u5668\u901a\u8fc7Set-Cookie\u54cd\u5e94\u5934，\u5c06session_id\u5199\u5165\u6d4f\u89c8\u5668Cookie]<\/p>\n
\u00a0\u00a0\u00a0 E –> F[\u7528\u6237\u540e\u7eed\u8bf7\u6c42\u4efb\u610f\u63a5\u53e3]<\/p>\n
\u00a0\u00a0\u00a0 F –> G[\u6d4f\u89c8\u5668\u81ea\u52a8\u643a\u5e26Cookie\u5230\u670d\u52a1\u5668]<\/p>\n
\u00a0\u00a0\u00a0 G –> H[\u670d\u52a1\u5668\u89e3\u6790Cookie\u4e2d\u7684session_id，\u9a8c\u8bc1\u7528\u6237\u8eab\u4efd]<\/p>\n
\u00a0\u00a0\u00a0 H –> I[\u8fd4\u56de\u5bf9\u5e94\u7528\u6237\u7684\u4e2a\u6027\u5316\u5185\u5bb9]<\/p>\n
\u00a0\u00a0\u00a0 J[\u7528\u6237\u767b\u51fa] –> K[\u670d\u52a1\u5668\u8bbe\u7f6eCookie\u8fc7\u671f，\u6d4f\u89c8\u5668\u5220\u9664\u8be5Cookie]<\/p>\n
```<\/p>\n
\n
### \u4e09\u3001Cookie \u7684\u5173\u952e\u7ba1\u7406\u65b9\u5f0f（\u542b\u5b89\u5168\u914d\u7f6e）<\/p>\n
\u5728\u767b\u5f55\u7cfb\u7edf\u4e2d，Cookie \u7ba1\u7406\u7684\u6838\u5fc3\u662f**\u5b89\u5168\u5b58\u50a8**\u548c**\u6709\u6548\u9a8c\u8bc1**，\u5173\u952e\u914d\u7f6e\u5982\u4e0b：<\/p>\n
#### 1. \u670d\u52a1\u7aef\u8bbe\u7f6e Cookie（\u4ee5 Node.js\/Express \u4e3a\u4f8b）<\/p>\n
```javascript<\/p>\n
const express = require('express');<\/p>\n
const app = express();<\/p>\n
const session = require('express-session');<\/p>\n
const redisStore = require('connect-redis')(session);<\/p>\n
const redis = require('redis');<\/p>\n
const client = redis.createClient({ host: 'localhost', port: 6379 });<\/p>\n
\n
\/\/ \u914d\u7f6esession（\u5e95\u5c42\u4f9d\u8d56Cookie）<\/p>\n
app.use(session({<\/p>\n
\u00a0 store: new redisStore({ client }), \/\/ session_id \u5173\u8054\u7684\u7528\u6237\u4fe1\u606f\u5b58\u5728Redis<\/p>\n
\u00a0 secret: 'your-secret-key', \/\/ \u52a0\u5bc6Cookie\u7684\u5bc6\u94a5（\u5fc5\u586b，\u9632\u6b62Cookie\u88ab\u7be1\u6539）<\/p>\n
\u00a0 resave: false,<\/p>\n
\u00a0 saveUninitialized: false,<\/p>\n
\u00a0 cookie: {<\/p>\n
\u00a0\u00a0\u00a0 httpOnly: true, \/\/ \u6838\u5fc3\u5b89\u5168\u5c5e\u6027，\u4e0b\u6587\u91cd\u70b9\u8bb2<\/p>\n
\u00a0\u00a0\u00a0 secure: process.env.NODE_ENV === 'production', \/\/ \u4ec5\u5728HTTPS\u4e0b\u4f20\u8f93（\u751f\u4ea7\u73af\u5883\u5fc5\u987b\u5f00\u542f）<\/p>\n
\u00a0\u00a0\u00a0 sameSite: 'strict', \/\/ \u9632\u6b62CSRF\u653b\u51fb，\u4ec5\u540c\u57df\u540d\u8bf7\u6c42\u643a\u5e26Cookie<\/p>\n
\u00a0\u00a0\u00a0 maxAge: 7 * 24 * 60 * 60 * 1000 \/\/ Cookie\u6709\u6548\u671f7\u5929（\u5bf9\u5e94\u201c\u8bb0\u4f4f\u6211\u201d\u529f\u80fd）<\/p>\n
\u00a0 }<\/p>\n
}));<\/p>\n
\n
\/\/ \u767b\u5f55\u63a5\u53e3<\/p>\n
app.post('\/login', (req, res) => {<\/p>\n
\u00a0 const { username, password } = req.body;<\/p>\n
\u00a0 \/\/ \u6a21\u62df\u9a8c\u8bc1\u8d26\u53f7\u5bc6\u7801（\u5b9e\u9645\u9879\u76ee\u4e2d\u9700\u67e5\u6570\u636e\u5e93+\u5bc6\u7801\u52a0\u5bc6\u9a8c\u8bc1）<\/p>\n
\u00a0 if (username === 'admin' && password === '123456') {<\/p>\n
\u00a0\u00a0\u00a0 req.session.user = { username, id: 1 }; \/\/ \u5c06\u7528\u6237\u4fe1\u606f\u5173\u8054\u5230session<\/p>\n
\u00a0\u00a0\u00a0 res.json({ code: 200, msg: '\u767b\u5f55\u6210\u529f' });<\/p>\n
\u00a0 } else {<\/p>\n
\u00a0\u00a0\u00a0 res.json({ code: 401, msg: '\u8d26\u53f7\u6216\u5bc6\u7801\u9519\u8bef' });<\/p>\n
\u00a0 }<\/p>\n
});<\/p>\n
\n
\/\/ \u9a8c\u8bc1\u767b\u5f55\u72b6\u6001\u7684\u63a5\u53e3<\/p>\n
app.get('\/profile', (req, res) => {<\/p>\n
\u00a0 if (req.session.user) { \/\/ \u901a\u8fc7session_id\u9a8c\u8bc1\u7528\u6237\u8eab\u4efd<\/p>\n
\u00a0\u00a0\u00a0 res.json({ code: 200, data: req.session.user });<\/p>\n
\u00a0 } else {<\/p>\n
\u00a0\u00a0\u00a0 res.json({ code: 401, msg: '\u672a\u767b\u5f55' });<\/p>\n
\u00a0 }<\/p>\n
});<\/p>\n
\n
\/\/ \u767b\u51fa\u63a5\u53e3（\u6e05\u9664Cookie）<\/p>\n
app.post('\/logout', (req, res) => {<\/p>\n
\u00a0 req.session.destroy(); \/\/ \u9500\u6bc1\u670d\u52a1\u5668\u7aef\u7684session<\/p>\n
\u00a0 res.clearCookie('connect.sid'); \/\/ \u6e05\u9664\u6d4f\u89c8\u5668\u4e2d\u7684Cookie<\/p>\n
\u00a0 res.json({ code: 200, msg: '\u767b\u51fa\u6210\u529f' });<\/p>\n
});<\/p>\n
\n
app.listen(3000, () => console.log('\u670d\u52a1\u5668\u8fd0\u884c\u57283000\u7aef\u53e3'));<\/p>\n
```<\/p>\n
\n
#### 2. \u5173\u952e\u914d\u7f6e\u89e3\u91ca<\/p>\n
– `secret`：\u7528\u4e8e\u52a0\u5bc6 Cookie \u5185\u5bb9，\u9632\u6b62 Cookie \u88ab\u7be1\u6539（\u5982 `session_id` \u88ab\u4f2a\u9020）\u3002<\/p>\n
– `maxAge`：Cookie \u7684\u6709\u6548\u671f（\u6beb\u79d2），\u8bbe\u7f6e\u4e3a `0` \u6216\u8d1f\u6570\u8868\u793a\u5173\u95ed\u6d4f\u89c8\u5668\u5373\u5931\u6548（\u4e34\u65f6\u767b\u5f55），\u8bbe\u7f6e\u4e3a\u8f83\u5927\u503c\u5219\u5b9e\u73b0\u201c\u8bb0\u4f4f\u6211\u201d\u3002<\/p>\n
– `secure`：\u4ec5\u5728 HTTPS \u534f\u8bae\u4e0b\u4f20\u8f93 Cookie，\u9632\u6b62\u660e\u6587\u4f20\u8f93\u65f6\u88ab\u7a83\u53d6（\u751f\u4ea7\u73af\u5883\u5fc5\u987b\u5f00\u542f）\u3002<\/p>\n
– `sameSite`：\u9650\u5236 Cookie \u4ec5\u5728\u540c\u57df\u540d\u8bf7\u6c42\u4e2d\u643a\u5e26，\u9632\u8303 CSRF（\u8de8\u7ad9\u8bf7\u6c42\u4f2a\u9020）\u653b\u51fb\u3002<\/p>\n
\n
### \u56db\u3001HttpOnly \u8be6\u7ec6\u4ecb\u7ecd<\/p>\n
#### 1. \u5b9a\u4e49<\/p>\n
HttpOnly \u662f Cookie \u7684\u4e00\u4e2a**\u5b89\u5168\u5c5e\u6027**，\u5f53 Cookie \u88ab\u8bbe\u7f6e\u4e3a `HttpOnly=true` \u65f6，\u5ba2\u6237\u7aef\u7684 JavaScript \u65e0\u6cd5\u901a\u8fc7 `document.cookie` \u8bfb\u53d6\u6216\u4fee\u6539\u8be5 Cookie，\u53ea\u80fd\u7531\u6d4f\u89c8\u5668\u5728 HTTP\/HTTPS \u8bf7\u6c42\u4e2d\u81ea\u52a8\u643a\u5e26\u3002<\/p>\n
\n
#### 2. \u6838\u5fc3\u4f5c\u7528：\u62b5\u5fa1 XSS \u653b\u51fb<\/p>\n
XSS（\u8de8\u7ad9\u811a\u672c\u653b\u51fb）\u662f\u9ed1\u5ba2\u5728\u9875\u9762\u4e2d\u6ce8\u5165\u6076\u610f JavaScript \u4ee3\u7801，\u82e5 Cookie \u672a\u8bbe\u7f6e HttpOnly，\u9ed1\u5ba2\u53ef\u901a\u8fc7 `document.cookie` \u83b7\u53d6\u7528\u6237\u7684 `session_id`，\u8fdb\u800c\u5192\u5145\u7528\u6237\u767b\u5f55\u7cfb\u7edf\u3002<\/p>\n
\n
**\u5bf9\u6bd4\u793a\u4f8b**：<\/p>\n
– \u672a\u8bbe\u7f6e HttpOnly：`document.cookie` \u80fd\u8bfb\u53d6\u5230 `session_id=abc123`，\u9ed1\u5ba2\u53ef\u7a83\u53d6\u3002<\/p>\n
– \u8bbe\u7f6e HttpOnly：`document.cookie` \u65e0\u6cd5\u8bfb\u53d6\u8be5 Cookie，XSS \u653b\u51fb\u65e0\u6cd5\u83b7\u53d6 `session_id`\u3002<\/p>\n
\n
#### 3. \u4f7f\u7528\u6ce8\u610f\u4e8b\u9879<\/p>\n
– HttpOnly \u4ec5\u9650\u5236\u524d\u7aef JS \u8bbf\u95ee，\u4e0d\u5f71\u54cd\u6d4f\u89c8\u5668\u81ea\u52a8\u643a\u5e26 Cookie \u5230\u670d\u52a1\u5668（\u4e0d\u5f71\u54cd\u767b\u5f55\u72b6\u6001\u9a8c\u8bc1）\u3002<\/p>\n
– \u65e0\u6cd5\u901a\u8fc7\u524d\u7aef\u4ee3\u7801\u4fee\u6539 HttpOnly Cookie，\u53ea\u80fd\u7531\u670d\u52a1\u5668\u901a\u8fc7 `Set-Cookie` \u6216 `clearCookie` \u7ba1\u7406\u3002<\/p>\n
– \u5fc5\u987b\u4e0e `secure` \u914d\u5408\u4f7f\u7528（HTTPS），\u5426\u5219 Cookie \u4ecd\u53ef\u80fd\u5728\u4f20\u8f93\u8fc7\u7a0b\u4e2d\u88ab\u7a83\u53d6\u3002<\/p>\n
\n
### \u603b\u7ed3<\/p>\n
1. Cookie \u662f\u767b\u5f55\u7cfb\u7edf\u4e2d\u89e3\u51b3 HTTP \u65e0\u72b6\u6001\u95ee\u9898\u7684\u6838\u5fc3，\u901a\u8fc7\u5b58\u50a8 `session_id` \u5b9e\u73b0\u7528\u6237\u8eab\u4efd\u8bc6\u522b\u548c\u72b6\u6001\u4fdd\u6301\u3002<\/p>\n
2. HttpOnly \u662f Cookie \u7684\u5173\u952e\u5b89\u5168\u5c5e\u6027，\u7981\u6b62\u524d\u7aef JS \u8bbf\u95ee Cookie，\u6838\u5fc3\u7528\u4e8e\u62b5\u5fa1 XSS \u653b\u51fb，\u4fdd\u62a4\u7528\u6237\u767b\u5f55\u51ed\u8bc1\u3002<\/p>\n
3. \u767b\u5f55\u7cfb\u7edf\u4e2d\u7ba1\u7406 Cookie \u9700\u914d\u7f6e `HttpOnly`\u3001`secure`\u3001`sameSite` \u7b49\u5b89\u5168\u5c5e\u6027，\u5e76\u5408\u7406\u8bbe\u7f6e\u8fc7\u671f\u65f6\u95f4，\u767b\u51fa\u65f6\u9700\u540c\u65f6\u9500\u6bc1\u670d\u52a1\u5668\u7aef session \u548c\u6d4f\u89c8\u5668\u7aef Cookie\u3002<\/p>\n
\n
HTTP（\u8d85\u6587\u672c\u4f20\u8f93\u534f\u8bae）\u548c HTTPS（\u8d85\u6587\u672c\u4f20\u8f93\u5b89\u5168\u534f\u8bae）\u7684\u6838\u5fc3\u533a\u522b\u5728\u4e8e**\u662f\u5426\u5bf9\u4f20\u8f93\u6570\u636e\u8fdb\u884c\u52a0\u5bc6**，\u4ee5\u53ca\u7531\u6b64\u884d\u751f\u7684\u5b89\u5168\u6027\u3001\u4f20\u8f93\u673a\u5236\u7b49\u5dee\u5f02\u3002\u4ee5\u4e0b\u662f\u8be6\u7ec6\u7684\u5bf9\u6bd4\u548c\u89e3\u6790：<\/p>\n
\n
### \u4e00\u3001\u6838\u5fc3\u5b9a\u4e49\u4e0e\u672c\u8d28\u533a\u522b<\/p>\n
| \u7279\u6027 | **HTTP** | **HTTPS** |<\/p>\n
|——|———-|———–|<\/p>\n
| \u672c\u8d28 | \u660e\u6587\u4f20\u8f93\u7684\u5e94\u7528\u5c42\u534f\u8bae | HTTP + **SSL\/TLS \u52a0\u5bc6\u5c42**\u7684\u5b89\u5168\u534f\u8bae |<\/p>\n
| \u4f20\u8f93\u5b89\u5168\u6027 | \u6240\u6709\u6570\u636e**\u660e\u6587\u4f20\u8f93**，\u53ef\u88ab\u7a83\u542c\u3001\u7be1\u6539\u3001\u4f2a\u9020 | \u6570\u636e\u7ecf\u52a0\u5bc6\u540e\u4f20\u8f93，\u9632\u7a83\u542c\u3001\u9632\u7be1\u6539\u3001\u9632\u4f2a\u9020 |<\/p>\n
| \u7aef\u53e3\u53f7 | \u9ed8\u8ba4 80 | \u9ed8\u8ba4 443 |<\/p>\n
| \u8bc1\u4e66\u8981\u6c42 | \u65e0\u4efb\u4f55\u8bc1\u4e66\u8981\u6c42 | \u5fc5\u987b\u914d\u7f6e\u7531**\u6743\u5a01 CA（\u8bc1\u4e66\u9881\u53d1\u673a\u6784）** \u9881\u53d1\u7684\u6570\u5b57\u8bc1\u4e66 |<\/p>\n
| \u6838\u5fc3\u52a0\u5bc6\u673a\u5236 | \u65e0\u52a0\u5bc6 | \u7ed3\u5408**\u975e\u5bf9\u79f0\u52a0\u5bc6**（\u8eab\u4efd\u9a8c\u8bc1\u3001\u5bc6\u94a5\u534f\u5546）\u548c**\u5bf9\u79f0\u52a0\u5bc6**（\u6570\u636e\u4f20\u8f93） |<\/p>\n
| \u8d44\u6e90\u6d88\u8017 | \u65e0\u52a0\u5bc6\u89e3\u5bc6\u5f00\u9500，\u6027\u80fd\u66f4\u9ad8 | \u52a0\u5bc6\u89e3\u5bc6\u8fc7\u7a0b\u4f1a\u4ea7\u751f\u8f7b\u5fae\u6027\u80fd\u635f\u8017（\u53ef\u901a\u8fc7\u4f18\u5316 TLS \u7248\u672c\u964d\u4f4e） |<\/p>\n
| SEO \u5f71\u54cd | \u641c\u7d22\u5f15\u64ce\u65e0\u7279\u6b8a\u4f18\u5f85 | \u8c37\u6b4c\u3001\u767e\u5ea6\u7b49\u641c\u7d22\u5f15\u64ce\u4f18\u5148\u6536\u5f55，\u6392\u540d\u6743\u91cd\u66f4\u9ad8 |<\/p>\n
| Cookie \u5b89\u5168\u5c5e\u6027 | `secure` \u5c5e\u6027\u65e0\u6548（\u5f3a\u5236\u5ffd\u7565） | `secure` \u5c5e\u6027\u751f\u6548（\u4ec5\u5728 HTTPS \u4e0b\u643a\u5e26 Cookie） |<\/p>\n
\n
### \u4e8c\u3001\u5173\u952e\u5dee\u5f02\u7684\u6df1\u5ea6\u89e3\u6790<\/p>\n
#### 1. \u4f20\u8f93\u5b89\u5168\u6027（\u6700\u6838\u5fc3\u533a\u522b）<\/p>\n
– **HTTP**：\u6570\u636e\u5728\u5ba2\u6237\u7aef\u4e0e\u670d\u52a1\u5668\u4e4b\u95f4\u4ee5**\u660e\u6587\u5f62\u5f0f**\u4f20\u8f93\u3002<\/p>\n
\u00a0 \u653b\u51fb\u8005\u82e5\u5728\u4f20\u8f93\u94fe\u8def\u4e2d\u8fdb\u884c**\u4e2d\u95f4\u4eba\u653b\u51fb（MITM）**，\u53ef\u4ee5\u76f4\u63a5\u7a83\u53d6\u3001\u7be1\u6539\u8bf7\u6c42\u548c\u54cd\u5e94\u5185\u5bb9\u3002\u6bd4\u5982\u7528\u6237\u767b\u5f55\u65f6\u7684\u8d26\u53f7\u5bc6\u7801\u3001\u4ea4\u6613\u4fe1\u606f\u7b49\u654f\u611f\u6570\u636e\u4f1a\u76f4\u63a5\u66b4\u9732\u3002<\/p>\n
– **HTTPS**：\u5728 HTTP \u4e0e TCP \u4e4b\u95f4\u589e\u52a0\u4e86 **SSL\/TLS \u52a0\u5bc6\u5c42**，\u4f20\u8f93\u6d41\u7a0b\u5982\u4e0b：<\/p>\n
\u00a0 1.\u00a0 **\u8eab\u4efd\u9a8c\u8bc1**：\u5ba2\u6237\u7aef\u53d1\u8d77\u8bf7\u6c42\u65f6，\u670d\u52a1\u5668\u5148\u53d1\u9001\u81ea\u5df1\u7684\u6570\u5b57\u8bc1\u4e66，\u5ba2\u6237\u7aef\u9a8c\u8bc1\u8bc1\u4e66\u7684\u5408\u6cd5\u6027（\u662f\u5426\u7531\u53ef\u4fe1 CA \u9881\u53d1\u3001\u662f\u5426\u88ab\u7be1\u6539）\u3002<\/p>\n
\u00a0 2.\u00a0 **\u5bc6\u94a5\u534f\u5546**：\u9a8c\u8bc1\u901a\u8fc7\u540e，\u5ba2\u6237\u7aef\u4e0e\u670d\u52a1\u5668\u901a\u8fc7**\u975e\u5bf9\u79f0\u52a0\u5bc6**\u534f\u5546\u751f\u6210\u4e00\u4e2a**\u5bf9\u79f0\u52a0\u5bc6\u5bc6\u94a5**（\u975e\u5bf9\u79f0\u52a0\u5bc6\u6548\u7387\u4f4e，\u4ec5\u7528\u4e8e\u534f\u5546\u5bc6\u94a5）\u3002<\/p>\n
\u00a0 3.\u00a0 **\u6570\u636e\u4f20\u8f93**：\u540e\u7eed\u6240\u6709\u8bf7\u6c42\u548c\u54cd\u5e94\u6570\u636e，\u90fd\u901a\u8fc7**\u5bf9\u79f0\u52a0\u5bc6\u5bc6\u94a5**\u52a0\u5bc6\u540e\u4f20\u8f93，\u653b\u51fb\u8005\u5373\u4f7f\u622a\u53d6\u6570\u636e，\u4e5f\u65e0\u6cd5\u89e3\u5bc6\u3002<\/p>\n
\n
#### 2. \u6570\u5b57\u8bc1\u4e66\u7684\u4f5c\u7528<\/p>\n
HTTPS \u4f9d\u8d56\u6570\u5b57\u8bc1\u4e66\u89e3\u51b3\u4e24\u4e2a\u6838\u5fc3\u95ee\u9898：<\/p>\n
– **\u8eab\u4efd\u53ef\u4fe1**：\u786e\u4fdd\u5ba2\u6237\u7aef\u8bbf\u95ee\u7684\u670d\u52a1\u5668\u662f\u771f\u5b9e\u76ee\u6807\u670d\u52a1\u5668，\u800c\u975e\u4f2a\u9020\u7684\u9493\u9c7c\u670d\u52a1\u5668\u3002<\/p>\n
– **\u5bc6\u94a5\u5b89\u5168**：\u901a\u8fc7\u8bc1\u4e66\u4e2d\u7684\u516c\u94a5，\u5b9e\u73b0\u5ba2\u6237\u7aef\u4e0e\u670d\u52a1\u5668\u7684\u5b89\u5168\u5bc6\u94a5\u534f\u5546，\u907f\u514d\u5bc6\u94a5\u5728\u4f20\u8f93\u4e2d\u88ab\u7a83\u53d6\u3002<\/p>\n
\n
\u5982\u679c\u8bc1\u4e66\u4e0d\u88ab\u5ba2\u6237\u7aef\u4fe1\u4efb（\u6bd4\u5982\u81ea\u7b7e\u540d\u8bc1\u4e66），\u6d4f\u89c8\u5668\u4f1a\u5f39\u51fa\u5b89\u5168\u8b66\u544a，\u963b\u6b62\u7528\u6237\u7ee7\u7eed\u8bbf\u95ee\u3002<\/p>\n
\n
#### 3. \u4e0e Cookie \u5b89\u5168\u914d\u7f6e\u7684\u5173\u8054<\/p>\n
\u7ed3\u5408\u4f60\u4e4b\u524d\u5173\u6ce8\u7684\u767b\u5f55\u7cfb\u7edf Cookie \u7ba1\u7406：<\/p>\n
– HTTPS \u662f Cookie `secure` \u5c5e\u6027\u751f\u6548\u7684\u524d\u63d0：\u5f53 Cookie \u8bbe\u7f6e `secure: true` \u65f6，**\u4ec5\u5728 HTTPS \u8fde\u63a5\u4e0b**\u6d4f\u89c8\u5668\u624d\u4f1a\u643a\u5e26\u8be5 Cookie \u53d1\u9001\u8bf7\u6c42，HTTP \u8fde\u63a5\u4e0b\u4f1a\u81ea\u52a8\u5ffd\u7565，\u9632\u6b62 Cookie \u660e\u6587\u6cc4\u9732\u3002<\/p>\n
– \u642d\u914d `HttpOnly` \u548c `sameSite` \u5c5e\u6027，HTTPS \u53ef\u5b9e\u73b0 Cookie \u7684\u5168\u65b9\u4f4d\u5b89\u5168\u9632\u62a4，\u62b5\u5fa1 XSS\u3001CSRF \u7b49\u653b\u51fb\u3002<\/p>\n
\n
### \u4e09\u3001\u9002\u7528\u573a\u666f\u5bf9\u6bd4<\/p>\n
– **HTTP**：\u9002\u7528\u4e8e**\u975e\u654f\u611f\u6570\u636e**\u7684\u4f20\u8f93，\u6bd4\u5982\u9759\u6001\u8d44\u6e90（\u7eaf\u6587\u672c\u6587\u7ae0\u3001\u516c\u5f00\u56fe\u7247）\u3001\u975e\u767b\u5f55\u72b6\u6001\u7684\u516c\u5f00\u9875\u9762\u3002<\/p>\n
\u00a0 \u76ee\u524d\u4e3b\u6d41\u7f51\u7ad9\u5df2\u57fa\u672c\u6dd8\u6c70 HTTP，\u4ec5\u90e8\u5206\u5c0f\u4f17\u7ad9\u70b9\u6216\u5185\u90e8\u6d4b\u8bd5\u7cfb\u7edf\u4ecd\u5728\u4f7f\u7528\u3002<\/p>\n
– **HTTPS**：\u9002\u7528\u4e8e\u6240\u6709\u6d89\u53ca**\u654f\u611f\u6570\u636e**\u7684\u573a\u666f，\u5305\u62ec\u7528\u6237\u767b\u5f55\u3001\u7535\u5546\u652f\u4ed8\u3001\u4e2a\u4eba\u4fe1\u606f\u67e5\u8be2\u3001\u91d1\u878d\u4ea4\u6613\u7b49\u3002<\/p>\n
\u00a0 \u73b0\u5728\u662f\u4e3b\u6d41\u4e92\u8054\u7f51\u670d\u52a1\u7684\u6807\u914d\u534f\u8bae\u3002<\/p>\n
\n
# SSL \u8be6\u89e3：\u5b9a\u4e49\u3001\u5de5\u4f5c\u673a\u5236\u3001\u8bc1\u4e66\u7b7e\u53d1\u4e0e\u5b9e\u9645\u5e94\u7528<\/p>\n
SSL \u7684\u5168\u79f0\u662f **Secure Sockets Layer（\u5b89\u5168\u5957\u63a5\u5c42）**，\u662f\u4e00\u79cd\u7528\u4e8e\u5728\u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u4e4b\u95f4\u5efa\u7acb\u52a0\u5bc6\u8fde\u63a5\u7684\u5b89\u5168\u534f\u8bae\u3002\u5b83\u7684\u6838\u5fc3\u76ee\u6807\u662f\u89e3\u51b3 HTTP \u660e\u6587\u4f20\u8f93\u7684\u5b89\u5168\u9690\u60a3，\u540e\u6765\u88ab **TLS（Transport Layer Security，\u4f20\u8f93\u5c42\u5b89\u5168）** \u534f\u8bae\u53d6\u4ee3（SSL 3.0 \u4e4b\u540e\u7684\u7248\u672c\u5747\u88ab\u7eb3\u5165 TLS \u4f53\u7cfb），\u4f46\u65e5\u5e38\u5f00\u53d1\u548c\u8fd0\u7ef4\u4e2d\u4ecd\u4e60\u60ef\u5c06\u4e24\u8005\u7edf\u79f0\u4e3a **SSL\/TLS**\u3002<\/p>\n
\n
## \u4e00\u3001SSL \u7684\u6838\u5fc3\u529f\u80fd<\/p>\n
SSL \u534f\u8bae\u4f4d\u4e8e **\u5e94\u7528\u5c42（HTTP）** \u548c **\u4f20\u8f93\u5c42（TCP）** \u4e4b\u95f4，\u901a\u8fc7\u4e09\u5927\u6838\u5fc3\u80fd\u529b\u4fdd\u969c\u6570\u636e\u4f20\u8f93\u5b89\u5168：<\/p>\n
1. **\u6570\u636e\u52a0\u5bc6**<\/p>\n
\u00a0\u00a0 \u91c7\u7528 **\u975e\u5bf9\u79f0\u52a0\u5bc6 + \u5bf9\u79f0\u52a0\u5bc6** \u7ed3\u5408\u7684\u65b9\u5f0f：<\/p>\n
\u00a0\u00a0 – \u975e\u5bf9\u79f0\u52a0\u5bc6（\u5982 RSA）：\u4ec5\u7528\u4e8e**\u5bc6\u94a5\u534f\u5546**，\u89e3\u51b3\u5bf9\u79f0\u52a0\u5bc6\u5bc6\u94a5\u7684\u5b89\u5168\u4f20\u8f93\u95ee\u9898\u3002<\/p>\n
\u00a0\u00a0 – \u5bf9\u79f0\u52a0\u5bc6（\u5982 AES）：\u7528\u4e8e**\u5b9e\u9645\u6570\u636e\u4f20\u8f93**，\u52a0\u5bc6\u548c\u89e3\u5bc6\u901f\u5ea6\u5feb，\u9002\u5408\u5927\u91cf\u6570\u636e\u7684\u52a0\u5bc6\u3002<\/p>\n
2. **\u8eab\u4efd\u9a8c\u8bc1**<\/p>\n
\u00a0\u00a0 \u901a\u8fc7 **SSL \u6570\u5b57\u8bc1\u4e66** \u9a8c\u8bc1\u670d\u52a1\u5668（\u6216\u5ba2\u6237\u7aef）\u7684\u771f\u5b9e\u8eab\u4efd，\u9632\u6b62\u4e2d\u95f4\u4eba\u653b\u51fb\u548c\u9493\u9c7c\u7f51\u7ad9\u3002<\/p>\n
3. **\u6570\u636e\u5b8c\u6574\u6027\u6821\u9a8c**<\/p>\n
\u00a0\u00a0 \u901a\u8fc7 **\u6d88\u606f\u8ba4\u8bc1\u7801（MAC）** \u6216 **\u54c8\u5e0c\u7b97\u6cd5（\u5982 SHA-256）** \u6821\u9a8c\u6570\u636e，\u786e\u4fdd\u4f20\u8f93\u8fc7\u7a0b\u4e2d\u6570\u636e\u672a\u88ab\u7be1\u6539\u3002<\/p>\n
\n
## \u4e8c\u3001SSL \u7684\u5de5\u4f5c\u6d41\u7a0b（SSL \u63e1\u624b\u8fc7\u7a0b）<\/p>\n
SSL \u8fde\u63a5\u7684\u5efa\u7acb\u4f9d\u8d56**\u63e1\u624b\u9636\u6bb5**\u5b8c\u6210\u5bc6\u94a5\u534f\u5546\u548c\u8eab\u4efd\u9a8c\u8bc1，\u4ee5 HTTPS \u4e3a\u4f8b，\u5b8c\u6574\u6d41\u7a0b\u5982\u4e0b：<\/p>\n
1. **\u5ba2\u6237\u7aef\u95ee\u5019**<\/p>\n
\u00a0\u00a0 \u5ba2\u6237\u7aef\u5411\u670d\u52a1\u5668\u53d1\u9001\u8bf7\u6c42，\u5305\u542b\u652f\u6301\u7684 SSL\/TLS \u7248\u672c\u3001\u52a0\u5bc6\u5957\u4ef6\u5217\u8868\u3001\u968f\u673a\u6570 `Client Random`\u3002<\/p>\n
2. **\u670d\u52a1\u5668\u54cd\u5e94**<\/p>\n
\u00a0\u00a0 \u670d\u52a1\u5668\u9009\u62e9\u5408\u9002\u7684 SSL\/TLS \u7248\u672c\u548c\u52a0\u5bc6\u5957\u4ef6，\u8fd4\u56de\u968f\u673a\u6570 `Server Random`，\u5e76\u53d1\u9001**\u670d\u52a1\u5668 SSL \u8bc1\u4e66**（\u5305\u542b\u670d\u52a1\u5668\u516c\u94a5\u3001\u8bc1\u4e66\u9881\u53d1\u673a\u6784 CA\u3001\u6709\u6548\u671f\u7b49\u4fe1\u606f）\u3002<\/p>\n
3. **\u5ba2\u6237\u7aef\u9a8c\u8bc1\u8bc1\u4e66**<\/p>\n
\u00a0\u00a0 \u5ba2\u6237\u7aef\u9a8c\u8bc1\u670d\u52a1\u5668\u8bc1\u4e66\u7684\u5408\u6cd5\u6027：<\/p>\n
\u00a0\u00a0 – \u68c0\u67e5\u8bc1\u4e66\u662f\u5426\u7531\u53ef\u4fe1 CA \u7b7e\u53d1；<\/p>\n
\u00a0\u00a0 – \u68c0\u67e5\u8bc1\u4e66\u662f\u5426\u8fc7\u671f；<\/p>\n
\u00a0\u00a0 – \u68c0\u67e5\u8bc1\u4e66\u4e2d\u7684\u57df\u540d\u662f\u5426\u4e0e\u5f53\u524d\u8bbf\u95ee\u57df\u540d\u4e00\u81f4\u3002<\/p>\n
\u00a0\u00a0 \u82e5\u9a8c\u8bc1\u5931\u8d25，\u6d4f\u89c8\u5668\u4f1a\u5f39\u51fa\u5b89\u5168\u8b66\u544a，\u963b\u6b62\u7ee7\u7eed\u8bbf\u95ee\u3002<\/p>\n
4. **\u5bc6\u94a5\u534f\u5546**<\/p>\n
\u00a0\u00a0 \u5ba2\u6237\u7aef\u751f\u6210\u4e00\u4e2a**\u9884\u4e3b\u5bc6\u94a5（Pre-Master Secret）**，\u7528\u670d\u52a1\u5668\u8bc1\u4e66\u4e2d\u7684\u516c\u94a5\u52a0\u5bc6\u540e\u53d1\u9001\u7ed9\u670d\u52a1\u5668；\u670d\u52a1\u5668\u7528\u81ea\u5df1\u7684\u79c1\u94a5\u89e3\u5bc6\u5f97\u5230\u9884\u4e3b\u5bc6\u94a5\u3002<\/p>\n
5. **\u751f\u6210\u4f1a\u8bdd\u5bc6\u94a5**<\/p>\n
\u00a0\u00a0 \u5ba2\u6237\u7aef\u548c\u670d\u52a1\u5668\u5206\u522b\u5229\u7528 `Client Random`\u3001`Server Random` \u548c\u9884\u4e3b\u5bc6\u94a5，\u901a\u8fc7\u76f8\u540c\u7b97\u6cd5\u751f\u6210**\u4f1a\u8bdd\u5bc6\u94a5（\u5bf9\u79f0\u5bc6\u94a5）**\u3002<\/p>\n
6. **\u52a0\u5bc6\u4f20\u8f93**<\/p>\n
\u00a0\u00a0 \u540e\u7eed\u6240\u6709 HTTP \u8bf7\u6c42\u548c\u54cd\u5e94\u6570\u636e，\u90fd\u901a\u8fc7\u4f1a\u8bdd\u5bc6\u94a5\u52a0\u5bc6\u540e\u4f20\u8f93，\u63e1\u624b\u9636\u6bb5\u7ed3\u675f\u3002<\/p>\n
\n
## \u4e09\u3001SSL \u8bc1\u4e66\u7684\u7b7e\u53d1：\u7c7b\u578b\u3001\u6d41\u7a0b\u4e0e CA \u673a\u6784<\/p>\n
SSL \u8bc1\u4e66\u662f SSL \u534f\u8bae\u5b9e\u73b0\u8eab\u4efd\u9a8c\u8bc1\u7684\u6838\u5fc3，\u7531**\u6743\u5a01 CA（Certificate Authority，\u8bc1\u4e66\u9881\u53d1\u673a\u6784）** \u7b7e\u53d1，\u672c\u8d28\u662f\u4e00\u4efd\u5305\u542b\u670d\u52a1\u5668\u516c\u94a5\u548c\u8eab\u4efd\u4fe1\u606f\u7684\u6570\u5b57\u51ed\u8bc1\u3002<\/p>\n
\n
### 1. SSL \u8bc1\u4e66\u7684\u7c7b\u578b（\u6309\u9a8c\u8bc1\u7ea7\u522b\u5212\u5206）<\/p>\n
| \u8bc1\u4e66\u7c7b\u578b | \u9a8c\u8bc1\u5f3a\u5ea6 | \u9002\u7528\u573a\u666f | \u7279\u70b9 |<\/p>\n
|———-|———-|———-|——|<\/p>\n
| **DV（\u57df\u540d\u9a8c\u8bc1\u578b）** | \u6700\u4f4e | \u4e2a\u4eba\u535a\u5ba2\u3001\u5c0f\u578b\u7f51\u7ad9 | \u4ec5\u9a8c\u8bc1\u57df\u540d\u6240\u6709\u6743，\u7b7e\u53d1\u901f\u5ea6\u5feb（\u51e0\u5206\u949f\u5230\u51e0\u5c0f\u65f6），\u514d\u8d39\u8bc1\u4e66\u591a\u4e3a\u6b64\u7c7b（\u5982 Let's Encrypt） |<\/p>\n
| **OV（\u7ec4\u7ec7\u9a8c\u8bc1\u578b）** | \u4e2d\u7b49 | \u4f01\u4e1a\u5b98\u7f51\u3001\u7535\u5546\u5e73\u53f0 | \u9a8c\u8bc1\u57df\u540d\u6240\u6709\u6743 + \u4f01\u4e1a\u771f\u5b9e\u8eab\u4efd，\u8bc1\u4e66\u4e2d\u4f1a\u663e\u793a\u4f01\u4e1a\u540d\u79f0，\u53ef\u4fe1\u5ea6\u8f83\u9ad8 |<\/p>\n
| **EV（\u6269\u5c55\u9a8c\u8bc1\u578b）** | \u6700\u9ad8 | \u91d1\u878d\u673a\u6784\u3001\u5927\u578b\u7535\u5546 | \u6700\u4e25\u683c\u7684\u9a8c\u8bc1\u6d41\u7a0b（\u9a8c\u8bc1\u4f01\u4e1a\u8eab\u4efd\u3001\u6cd5\u5f8b\u8d44\u8d28\u7b49），\u6d4f\u89c8\u5668\u5730\u5740\u680f\u4f1a\u663e\u793a\u7eff\u8272\u4f01\u4e1a\u540d\u79f0，\u5b89\u5168\u6027\u6700\u9ad8 |<\/p>\n
\n
### 2. SSL \u8bc1\u4e66\u7684\u7b7e\u53d1\u6d41\u7a0b（\u4ee5 DV \u8bc1\u4e66\u4e3a\u4f8b）<\/p>\n
1. **\u8bc1\u4e66\u7533\u8bf7**<\/p>\n
\u00a0\u00a0 \u5f00\u53d1\u8005\u5728 CA \u5e73\u53f0\u63d0\u4ea4\u7533\u8bf7，\u63d0\u4f9b\u9700\u8981\u7ed1\u5b9a\u7684\u57df\u540d（\u5982 `www.example.com`）\u3002<\/p>\n
2. **\u57df\u540d\u9a8c\u8bc1**<\/p>\n
\u00a0\u00a0 CA \u673a\u6784\u901a\u8fc7\u4ee5\u4e0b\u65b9\u5f0f\u4e4b\u4e00\u9a8c\u8bc1\u7533\u8bf7\u8005\u5bf9\u57df\u540d\u7684\u6240\u6709\u6743：<\/p>\n
\u00a0\u00a0 – **DNS \u9a8c\u8bc1**：\u8981\u6c42\u7533\u8bf7\u8005\u5728\u57df\u540d\u7684 DNS \u89e3\u6790\u4e2d\u6dfb\u52a0\u6307\u5b9a\u7684 TXT \u8bb0\u5f55；<\/p>\n
\u00a0\u00a0 – **HTTP \u9a8c\u8bc1**：\u8981\u6c42\u7533\u8bf7\u8005\u5728\u7f51\u7ad9\u6839\u76ee\u5f55\u4e0b\u653e\u7f6e CA \u63d0\u4f9b\u7684\u9a8c\u8bc1\u6587\u4ef6，CA \u4f1a\u8bbf\u95ee\u8be5\u6587\u4ef6\u786e\u8ba4\u3002<\/p>\n
3. **\u8bc1\u4e66\u751f\u6210\u4e0e\u9881\u53d1**<\/p>\n
\u00a0\u00a0 \u9a8c\u8bc1\u901a\u8fc7\u540e，CA \u673a\u6784\u7528\u81ea\u5df1\u7684\u79c1\u94a5\u7b7e\u53d1\u8bc1\u4e66，\u751f\u6210 `.crt`（\u8bc1\u4e66\u6587\u4ef6）\u548c `.key`（\u79c1\u94a5\u6587\u4ef6），\u53d1\u9001\u7ed9\u7533\u8bf7\u8005\u3002<\/p>\n
4. **\u8bc1\u4e66\u90e8\u7f72**<\/p>\n
\u00a0\u00a0 \u7533\u8bf7\u8005\u5c06\u8bc1\u4e66\u90e8\u7f72\u5230\u670d\u52a1\u5668（\u5982 Nginx\u3001Apache），\u914d\u7f6e HTTPS \u76d1\u542c\u7aef\u53e3（\u9ed8\u8ba4 443）\u3002<\/p>\n
\n
### 3. \u5e38\u89c1\u7684 CA \u673a\u6784<\/p>\n
– **\u514d\u8d39 CA**：Let's Encrypt（\u4e3b\u6d41\u514d\u8d39\u8bc1\u4e66，\u652f\u6301\u81ea\u52a8\u7eed\u671f）\u3001ZeroSSL；<\/p>\n
– **\u5546\u4e1a CA**：DigiCert（\u539f Symantec）\u3001GeoTrust\u3001GlobalSign\u3001\u963f\u91cc\u4e91\/\u817e\u8baf\u4e91\u7b49\u4e91\u5382\u5546\u63d0\u4f9b\u7684\u8bc1\u4e66\u670d\u52a1\u3002<\/p>\n
\n
## \u56db\u3001SSL \u7684\u5b9e\u9645\u5e94\u7528\u573a\u666f<\/p>\n
SSL \u4e0d\u4ec5\u7528\u4e8e HTTPS，\u8fd8\u5e7f\u6cdb\u5e94\u7528\u4e8e\u5404\u7c7b\u9700\u8981\u5b89\u5168\u4f20\u8f93\u7684\u573a\u666f：<\/p>\n
1. **HTTPS \u7f51\u7ad9（\u6700\u6838\u5fc3\u5e94\u7528）**<\/p>\n
\u00a0\u00a0 \u8fd9\u662f\u6700\u5e38\u89c1\u7684\u573a\u666f，\u6240\u6709\u6d89\u53ca\u7528\u6237\u767b\u5f55\u3001\u652f\u4ed8\u3001\u4e2a\u4eba\u4fe1\u606f\u7684\u7f51\u7ad9\u90fd\u5e94\u90e8\u7f72 SSL \u8bc1\u4e66，\u5b9e\u73b0\u6570\u636e\u52a0\u5bc6\u4f20\u8f93，\u540c\u65f6\u8ba9\u6d4f\u89c8\u5668\u5730\u5740\u680f\u663e\u793a\u9501\u5f62\u56fe\u6807，\u63d0\u5347\u7528\u6237\u4fe1\u4efb\u5ea6\u3002<\/p>\n
2. **\u90ae\u4ef6\u52a0\u5bc6**<\/p>\n
\u00a0\u00a0 \u90ae\u4ef6\u534f\u8bae（SMTP\u3001POP3\u3001IMAP）\u53ef\u901a\u8fc7 SSL \u52a0\u5bc6，\u9632\u6b62\u90ae\u4ef6\u5185\u5bb9\u548c\u767b\u5f55\u51ed\u8bc1\u88ab\u7a83\u53d6，\u5e38\u89c1\u7684\u52a0\u5bc6\u7aef\u53e3\u5982 SMTPs（465）\u3001IMAPs（993）\u3002<\/p>\n
3. **FTPS \u5b89\u5168\u6587\u4ef6\u4f20\u8f93**<\/p>\n
\u00a0\u00a0 \u4f20\u7edf FTP \u662f\u660e\u6587\u4f20\u8f93，FTPS \u57fa\u4e8e SSL\/TLS \u52a0\u5bc6 FTP \u8fde\u63a5，\u4fdd\u969c\u6587\u4ef6\u4f20\u8f93\u7684\u5b89\u5168\u6027，\u9002\u7528\u4e8e\u4f01\u4e1a\u5185\u90e8\u6587\u4ef6\u5206\u53d1\u3002<\/p>\n
4. **SSL VPN**<\/p>\n
\u00a0\u00a0 \u4f01\u4e1a\u8fdc\u7a0b\u529e\u516c\u5e38\u7528\u7684 VPN \u65b9\u6848，\u901a\u8fc7 SSL \u534f\u8bae\u5728\u516c\u7f51\u4e2d\u5efa\u7acb\u52a0\u5bc6\u96a7\u9053，\u5458\u5de5\u53ef\u5b89\u5168\u8bbf\u95ee\u4f01\u4e1a\u5185\u7f51\u8d44\u6e90\u3002<\/p>\n
5. **\u6570\u636e\u5e93\u52a0\u5bc6\u8fde\u63a5**<\/p>\n
\u00a0\u00a0 \u5982 MySQL\u3001PostgreSQL \u7b49\u6570\u636e\u5e93\u652f\u6301 SSL \u52a0\u5bc6\u8fde\u63a5，\u9632\u6b62\u6570\u636e\u5e93\u8d26\u53f7\u5bc6\u7801\u548c\u4f20\u8f93\u7684\u6570\u636e\u88ab\u4e2d\u95f4\u4eba\u7a83\u53d6\u3002<\/p>\n
6. **\u7269\u8054\u7f51（IoT）\u8bbe\u5907\u901a\u4fe1**<\/p>\n
\u00a0\u00a0 \u667a\u80fd\u8bbe\u5907（\u5982\u6444\u50cf\u5934\u3001\u4f20\u611f\u5668）\u4e0e\u4e91\u7aef\u7684\u901a\u4fe1\u53ef\u901a\u8fc7 SSL \u52a0\u5bc6，\u9632\u6b62\u8bbe\u5907\u88ab\u52ab\u6301\u6216\u6570\u636e\u88ab\u7be1\u6539\u3002<\/p>\n
\n
## \u4e94\u3001SSL \u8bc1\u4e66\u7684\u5b9e\u64cd\u6848\u4f8b：\u7b7e\u53d1\u4e0e\u90e8\u7f72（Let's Encrypt + Nginx）<\/p>\n
\u4ee5\u514d\u8d39\u7684 Let's Encrypt \u8bc1\u4e66\u4e3a\u4f8b，\u6f14\u793a\u5728 Nginx \u670d\u52a1\u5668\u4e0a\u7684\u7b7e\u53d1\u548c\u90e8\u7f72\u6d41\u7a0b：<\/p>\n
### 1. \u5b89\u88c5 Certbot \u5de5\u5177（Let's Encrypt \u5b98\u65b9\u5ba2\u6237\u7aef）<\/p>\n
```bash<\/p>\n
# Ubuntu\/Debian \u7cfb\u7edf<\/p>\n
sudo apt update && sudo apt install certbot python3-certbot-nginx<\/p>\n
```<\/p>\n
### 2. \u7533\u8bf7\u5e76\u81ea\u52a8\u90e8\u7f72\u8bc1\u4e66<\/p>\n
```bash<\/p>\n
# \u81ea\u52a8\u7533\u8bf7\u8bc1\u4e66\u5e76\u914d\u7f6e Nginx（\u4f1a\u81ea\u52a8\u4fee\u6539 Nginx \u914d\u7f6e\u6587\u4ef6）<\/p>\n
sudo certbot –nginx -d www.example.com -d example.com<\/p>\n
```<\/p>\n
### 3. \u9a8c\u8bc1\u90e8\u7f72\u7ed3\u679c<\/p>\n
\u8bbf\u95ee `https:\/\/www.example.com`，\u6d4f\u89c8\u5668\u5730\u5740\u680f\u663e\u793a\u9501\u5f62\u56fe\u6807，\u8bf4\u660e SSL \u8bc1\u4e66\u751f\u6548\u3002<\/p>\n
### 4. \u914d\u7f6e\u8bc1\u4e66\u81ea\u52a8\u7eed\u671f（Let's Encrypt \u8bc1\u4e66\u6709\u6548\u671f 90 \u5929）<\/p>\n
```bash<\/p>\n
# \u6dfb\u52a0\u5b9a\u65f6\u4efb\u52a1，\u81ea\u52a8\u7eed\u671f\u8bc1\u4e66<\/p>\n
sudo crontab -e<\/p>\n
# \u5728\u6587\u4ef6\u672b\u5c3e\u6dfb\u52a0：\u6bcf\u5929\u51cc\u6668 3 \u70b9\u68c0\u67e5\u5e76\u7eed\u671f<\/p>\n
0 3 * * * \/usr\/bin\/certbot renew –quiet<\/p>\n
```<\/p>\n
\n
## \u603b\u7ed3<\/p>\n
SSL \u662f\u5b9e\u73b0\u6570\u636e\u5b89\u5168\u4f20\u8f93\u7684\u6838\u5fc3\u534f\u8bae，\u5176\u672c\u8d28\u662f\u901a\u8fc7**\u52a0\u5bc6\u3001\u8eab\u4efd\u9a8c\u8bc1\u3001\u5b8c\u6574\u6027\u6821\u9a8c**\u89e3\u51b3\u7f51\u7edc\u4f20\u8f93\u7684\u5b89\u5168\u95ee\u9898；\u800c SSL \u8bc1\u4e66\u662f\u5b9e\u73b0\u8eab\u4efd\u9a8c\u8bc1\u7684\u5173\u952e\u8f7d\u4f53，\u7531\u6743\u5a01 CA \u7b7e\u53d1，\u4e0d\u540c\u9a8c\u8bc1\u7ea7\u522b\u7684\u8bc1\u4e66\u9002\u7528\u4e8e\u4e0d\u540c\u573a\u666f\u3002\u76ee\u524d SSL \u5df2\u88ab TLS \u53d6\u4ee3，\u4f46\u4e24\u8005\u7684\u6838\u5fc3\u539f\u7406\u548c\u5e94\u7528\u65b9\u5f0f\u5b8c\u5168\u4e00\u81f4，\u65e5\u5e38\u5f00\u53d1\u4e2d\u53ea\u9700\u5173\u6ce8 TLS 1.2\/1.3 \u7b49\u4e3b\u6d41\u7248\u672c\u7684\u914d\u7f6e\u5373\u53ef\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u5728\u4e00\u4e2a\u7528\u6237\u767b\u5f55\u7cfb\u7edf\u4e2d，cookie\u662f\u5982\u4f55\u53d1\u6325\u4f5c\u7528\u548c\u7ba1\u7406\u7684？\u4ee5\u53ca\u6bd4\u5982httponly\u4ecb\u7ecd### \u4e00\u3001Cookie \u5728\u7528\u6237\u767b\u5f55\u7cfb\u7edf\u4e2d\u7684\u6838\u5fc3\u4f5c\u7528HTTP \u534f\u8bae\u672c\u8eab\u662f**\u65e0\u72b6\u6001**\u7684（\u670d\u52a1\u5668\u65e0\u6cd5\u8bb0\u4f4f\u4e24\u6b21\u8bf7\u6c42\u662f\u5426\u6765\u81ea\u540c\u4e00\u4e2a\u7528\u6237），\u800c\u767b\u5f55\u7cfb\u7edf\u9700\u8981\u8bc6\u522b\u7528\u6237\u8eab\u4efd，Cookie \u6b63\u662f\u89e3\u51b3\u8fd9\u4e2a\u95ee\u9898\u7684\u6838\u5fc3\u624b\u6bb5，\u4e3b\u8981\u4f5c\u7528\u6709：1. **\u8eab\u4efd\u6807\u8bc6**：\u7528\u6237\u767b\u5f55\u6210\u529f\u540e，<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[10034,2386,622,606,87],"topic":[],"class_list":["post-88580","post","type-post","status-publish","format-standard","hentry","category-server","tag-vivo","tag-cookie","tag-https","tag-ssl","tag-87"],"yoast_head":"\n