Javascript 如何在javascript中使用MD5传输密码
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1962299/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to use MD5 in javascript to transmit a password
提问by adhanlon
I have a jquery dialog modal box pop up for logging into my website. When a user clicks login it does a post request to a login.php file as follows:
我有一个 jquery 对话框模式框弹出来登录我的网站。当用户单击登录时，它会向 login.php 文件发出一个 post 请求，如下所示：
$.post(
'includes/login.php',
{ user: username, pass: password },
onLogin,
'json' );
How do I do an md5 on that password before putting it in the post request? Also, I have the user's passwords stored in a MySQL database using MD5(), so I would like to just compare the stored version of the password with the MD5 of the password submitted. Thanks to anyone that replies.
在将其放入发布请求之前，如何对该密码进行 md5 处理？另外，我使用 MD5() 将用户的密码存储在 MySQL 数据库中，因此我只想将存储的密码版本与提交的密码的 MD5 进行比较。感谢任何回复的人。
回答by James Skidmore
crypto-jsis a rich javascript library containing many cryptography algorithms.
crypto-js是一个丰富的 javascript 库，包含许多加密算法。
All you have to do is just call CryptoJS.MD5(password)
你所要做的就是打电话 CryptoJS.MD5(password)
$.post(
'includes/login.php',
{ user: username, pass: CryptoJS.MD5(password) },
onLogin,
'json' );
回答by jt.
If someone is sniffing your plain-text HTTP traffic (or cache/cookies) for passwords just turning the password into a hash won't help - The hash password can be "replayed" just as well as plain-text. The client would need to hash the password with something somewhat random (like the date and time) See the section on "AUTH CRAM-MD5" here: http://www.fehcom.de/qmail/smtpauth.html
如果有人正在嗅探您的纯文本 HTTP 流量（或缓存/cookies）以获取密码，那么将密码转换为散列将无济于事 - 散列密码可以像纯文本一样“重播”。客户端需要使用一些随机的东西（如日期和时间）散列密码，请参阅此处的“AUTH CRAM-MD5”部分：http: //www.fehcom.de/qmail/smtpauth.html
回答by theCodeMachine
I would suggest you to use CryptoJS in this case.
在这种情况下，我建议您使用 CryptoJS。
Basically CryptoJS is a growing collection of standard and secure cryptographic algorithms implemented in JavaScript using best practices and patterns. They are fast, and they have a consistent and simple interface.
基本上，CryptoJS 是使用最佳实践和模式在 JavaScript 中实现的标准和安全加密算法的不断增长的集合。它们速度很快，并且具有一致且简单的界面。
So In case you want calculate hash(MD5) of your password string then do as follows :
因此，如果您想计算密码字符串的哈希（MD5），请执行以下操作：
<script src="http://crypto-js.googlecode.com/svn/tags/3.0.2/build/rollups/md5.js"></script>
<script>
var passhash = CryptoJS.MD5(password).toString();
$.post(
'includes/login.php',
{ user: username, pass: passhash },
onLogin,
'json' );
</script>
So this script will post hash of your password string to the server.
因此，此脚本会将您的密码字符串的哈希值发布到服务器。
For further info and support on other hash calculating algorithms you can visit at:
有关其他哈希计算算法的更多信息和支持，您可以访问：
回答by SapphireSun
You might want to check out this page: http://pajhome.org.uk/crypt/md5/
您可能想查看此页面：http: //pajhome.org.uk/crypt/md5/
However, if protecting the password is important, you should really be using something like SHA256 (MD5 is not cryptographically secure iirc). Even more, you might want to consider using TLS and getting a cert so you can use https.
但是，如果保护密码很重要，那么您确实应该使用 SHA256 之类的东西（MD5 不是加密安全的 iirc）。更重要的是，您可能需要考虑使用 TLS 并获取证书，以便您可以使用 https。
回答by James
In response to jt. You are correct, the HTML with just the password is susceptible to the Man in the middle attack. However, you can seed it with a GUID from the server ...
回应 jt。你是对的，只有密码的 HTML 很容易受到中间人攻击。但是，您可以使用来自服务器的 GUID 为其播种...
$.post(
'includes/login.php',
{ user: username, pass: $.md5(password + GUID) },
onLogin,
'json' );
This would defeat the Man-In-The middle ... in that the server would generate a new GUID for each attempt.
这将击败中间人......因为服务器将为每次尝试生成一个新的 GUID。
回答by fritz fritz Fritz
if you're using php jquery, this might help:
如果您使用的是 php jquery，这可能会有所帮助：
$.ajax({
url:'phpmd5file.php',
data:{'mypassword',mypassword},
dataType:"json",
method:"POST",
success:function(mymd5password){
alert(mymd5password);
}
});
on your phpmd5.php file:
在您的 phpmd5.php 文件中：
echo json_encode($_POST["mypassword"]);
echo json_encode($_POST["mypassword"]);
no jsplugins needed. just use ajax and let php md5() do the job.
不需要jsplugins。只需使用 ajax 并让 php md5() 完成这项工作。
