typescript Angular 2/4 存储令牌的位置
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/46301690/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Angular 2/4 where to store token
提问by user2870934
I have a rest api for generating token, which i'm using in angular 4 client side, but the question is where to store this token.
我有一个用于生成令牌的 rest api，我在 angular 4 客户端使用它，但问题是在哪里存储这个令牌。
In the internet i found that i can store in local storage or in the cookie.
在互联网上，我发现我可以存储在本地存储或 cookie 中。
So my question is, if store token is the local storage for example, and i have just copied the valid token from another browser, then i will have a valid token, so there is any security of storing token like that, and basically the same with cookies, or maybe i missed some important information?
所以我的问题是，例如，如果存储令牌是本地存储，并且我刚刚从另一个浏览器复制了有效令牌，那么我将拥有一个有效令牌，因此像这样存储令牌有任何安全性，并且基本相同使用cookies，或者我错过了一些重要信息？
回答by Alex Beugnet
Here is a complete article about Tokens / Cookies that can give you a lot of knowledge about this subject : auth0 : Cookies VS Tokens
这是一篇关于 Tokens / Cookies 的完整文章，可以为您提供有关此主题的很多知识：auth0：Cookies VS Tokens
I'll quote the most important parts to make you understand what's coming next :
我将引用最重要的部分，让您了解接下来会发生什么：
Two of the most common attack vectors facing websites are Cross Site Scripting (XSS) and Cross Site Request Forgery (XSRF or CSRF).
Cross Site Scripting) attacks occur when an outside entity is able to execute code within your website or app.
Cross Site Request Forgery attacks are not an issue if you are using JWT with local storage. On the other hand, if your use case requires you to store the JWT in a cookie, you will need to protect against XSRF.
Our CTO has argued in the past that XSS attacks are much easier to deal with compared to XSRF attacks because they are generally better understood.
网站面临的两种最常见的攻击媒介是跨站脚本 (XSS) 和跨站请求伪造（XSRF 或 CSRF）。
当外部实体能够在您的网站或应用程序中执行代码时，就会发生跨站点脚本）攻击。
如果您将 JWT 与本地存储一起使用，则跨站点请求伪造攻击不是问题。另一方面，如果您的用例要求您将 JWT 存储在 cookie 中，您将需要防止 XSRF。
我们的 CTO 过去曾辩称，与 XSRF 攻击相比，XSS 攻击更容易处理，因为它们通常更容易理解。
So basically to sum up :
所以基本上总结一下：
- XSSattacks are an issue with Tokensand LocalStorage. But it's not because Angular sanitizes everything, preventing efficiently XSSattacks. (https://angular.io/guide/security#angulars-cross-site-scripting-security-model)
- XSRFattacks are an issue with Cookies, and you would have to set up your own security framework to deal with them.
- XSS攻击是Tokens和LocalStorage的问题。但这并不是因为 Angular 会清理一切，有效地防止XSS攻击。（https://angular.io/guide/security#angulars-cross-site-scripting-security-model）
- XSRF攻击是Cookies 的一个问题，您必须建立自己的安全框架来处理它们。
Hence, I'd recommend a standard JWT Token approach to manage your token. Since your token is signed with the JWTformat, this is the safest solution in my opinion. Of course, a standard token would need to be either encryptedor signed(not the same) to be really secure.
因此，我建议使用标准的 JWT 令牌方法来管理您的令牌。由于您的令牌使用JWT格式签名，因此在我看来这是最安全的解决方案。当然，标准令牌需要加密或签名（不一样）才能真正安全。
Really easy to set up and manages with appropriate libraries (such as https://github.com/auth0/angular2-jwt)
使用适当的库（例如https://github.com/auth0/angular2-jwt）非常容易设置和管理
To go further :I imagine your token would be used for authentication, and be aware that people have already worked with that and know what is good / bad practice using them.
更进一步：我想您的令牌将用于身份验证，并注意人们已经使用过它并知道使用它们的好/坏做法。
You should take a look at how authentications are managed from working websites (such as Twitter / Facebook, etc...) where they use Refresh Tokens. Here are some additionnal links that could interest you :
您应该看看如何从使用Refresh Tokens 的工作网站（例如 Twitter / Facebook 等）管理身份验证。以下是您可能感兴趣的一些附加链接：
EDIT :Additionnal links about best practices with JWT :
编辑：关于 JWT 最佳实践的附加链接：
回答by Madhu Ranjan
Its more about how you are going to validate it than how you are storing token, what security majors you have taken to validate the same on the server side.
它更多地是关于你将如何验证它而不是你如何存储令牌，你已经采取了哪些安全专业来在服务器端验证相同。
You need to make sure that request is coming from valid client and not from malicious source, if you have CORS enabled API.
如果您有启用 CORS 的 API，您需要确保请求来自有效客户端而不是来自恶意来源。
If you are using Token to store confedential info, you need to encrypt it before storing.
如果您使用 Token 存储机密信息，则需要在存储前对其进行加密。
Hope this helps!!
希望这可以帮助！！
