Use Bearer tokens 为 API 认证
Bearer tokens 是 sent 在 Authorization 头: "Bearer <令牌>". Whoever holds 令牌能够 access API — protect 它 like password.
- 1
Bearer 令牌是 字符串该 grants access 到 API. 它是 sent as "Authorization: Bearer <令牌>". 服务器 verifies 令牌 (签名, expiration, 作用域) 和 grants 或 denies access. Bearer tokens 能够是 JWTs, opaque tokens (validated via introspection 端点), 或 API 关键. Treat 它们 as secrets — 它们 grant bearer access.
- 2 JWT 编码器 →
Create JWT Bearer 令牌. Set claims: sub (subject), exp (expiration), iat (issued 在), 作用域 (permissions). Sign 具有 RS256 (asymmetric) 或 HS256 (symmetric). 令牌是 self-contained — 服务器 verifies 签名无 数据库 lookup.
- 3 JWT 解码器 →
解码 and verify a Bearer JWT. Check the signature, expiration (exp), not-before (nbf), issuer (iss), and audience (aud). Reject tokens with invalid signatures or expired timestamps. Never skip signature verification.
- 4
常见问题
- JWT vs opaque 令牌?
- JWT 是 self-contained (claims embedded, verifiable 通过签名) — 否数据库 lookup needed, 但 larger 和 cannot 是 revoked 容易地. Opaque 令牌是 random 字符串 — 服务器必须 look 它上 (或调用 introspection 端点), 但它 能够是 revoked instantly 和是 smaller. Use JWT 为 stateless APIs, opaque 为 revocable access.
- 如何应该 I 存储 Bearer tokens 客户端-边?
- 在内存 (JavaScript 变量) 为 short-lived tokens — 最多安全但 lost 开 page refresh. 在 sessionStorage — survives refresh, 清晰开 tab close. 在 localStorage — persists across sessions, 但 vulnerable 到 XSS. 从不在 cookies 无 HttpOnly. 为 SPAs, use silent refresh (refresh 令牌在 HttpOnly Cookie, access 令牌在 内存).