What is aaUAE 's mandate? Ayasdi is focused on applications.Most of them protected by OAuth . 使用OAuth ,用户可以通过撤销令牌的方式随时决定收回确认。 With OAuth , the user can decide to recall the consent whenever by revoking the token. 在这篇文章中,我们将介绍OAuth ,并简要介绍每种授权流程的概念。 In this piece, we're going to look at OAuth , and give a brief rundown of each flow type.
Oauth _consumer_key,就是我们在创建应用时的Consumerkey.The oauth _consumer_key is the application key that we obtained in step 0.它以与代码流相同的方式开始,客户端向OAuth 服务器发出授权请求。 It starts out in the same way as the code flow, with the client making an authorization request to the OAuth server. OAuth 2显然是浪费时间(从大量参与其中的人的口中):.OAuth 2 is apparently a waste of time(from the mouth of someone that was heavily involved in it):. 如果任何OAuth 请求格式不正确,缺少数据或包含错误机密,则该请求将被拒绝。 If any of the OAuth request is malformed, missing data, or contains the wrong secret, the request will be rejected. OAuth 的应用场景通常是需要代表用户访问某些资源的客户端。The use case for OAuth is usually a client that needs to access some resource on behalf of the user. 在密码之外,您经常会遇到身份验证方案,如令牌共享(例如,oauth 或rsa令牌)。 Outside of the password, you often run into authentication schemes such as token sharing(e.g., OAuth or RSA tokens). OAuth 为这种模型引入了一种新的第三方角色:资源所有者。In OAuth , a new abstraction layer in the form of a third role is introduced: the resource owner. 支持Java、Go、Python等语言,使用LambCI的先决条件是AWS帐户和OAuth 令牌。 It supports languages like Java, Go, Python, etc. The prerequisite to use LambCI is AWS Account and OAuth token. OAuth 1.0要求客户端为每个API调用发送两个安全令牌,并使用两者来生成签名。OAuth 1.0 requires client to send two security tokens for each API call, and use both to generate the signature. 本文介绍了利用差OAuth 2.0实现并置于危险之中超过10亿的应用程序的攻击。 The paper describes an attack that takes advantage of poor OAuth 2.0 implementations and puts more than one billion apps in jeopardy. SSH密钥、OAuth 令牌、作业档案、及关联的用户信息不会传输到组织。 The SSH keys, OAuth tokens, job profile, and associated user information, will not be transferred to the organization. 所以,我们会通过添加OAuth 钓鱼问题将无法解决,但是我们看到越来越多的应用程序获取你的密码。 So, we get that the phishing problem won't get solved through adding OAuth , but we do see more and more applications getting your password. OAuth 被许多不同类型的API和应用使用,以前所未有的方式连接网络世界。OAuth is used for many different kinds of APIs and applications, connecting the online world in ways never before possible. 研究人员注意到OAuth 2.0不定义安全要求,也不及其后端如何应该安全地与第三方应用程序进行交互。 The researchers note that OAuth 2.0 does not define security requirements, nor how its backend should securely interact with third-party apps. 此类别包括由在线服务(如信用卡处理系统)提供的公共API,或用于共享访问用户数据的OAuth 。 This category includes public APIs provided by online services, such as credit card processing systems, or OAuth for shared access to user data. 第三代,OAuth 之类的技术在Web上管理用户身份,并让Web应用间的通联更加方便。 In the third generation, technologies such as OAuth helped to manage the user identities on the web and made federation across web apps easier. 第三方应用程序允许通过Facebook和谷歌的单点登录和支持OAuth 20协议,接触到帐户劫持。 Third-party applications that allow single sign-on via Facebook and Google and support the OAuth 2.0 protocol, are exposed to account hijacking. 我们认为OpenIDConnect和OAuth 2.0的组合是可预见在未来是保护现代应用程序的最佳方法。 We believe that the combination of OpenID Connect and OAuth 2.0 is the best approach to secure modern applications for the foreseeable future. OAuth 1.0协议(RFC5849)的安全性依赖于嵌入在客户端应用程序中的密钥可以保密的假设。Security of the OAuth 1.0 protocol(RFC 5849) relies on the assumption that a secret key embedded in a client application can be kept confidential. 生成令牌后,OAuth 1.0要求客户端在每个API调用中发送两个安全令牌,并使用两者来生成签名。 Once the token was generated, OAuth 1.0 required that the client send two security tokens on every API call, and use both to generate the signature. CloudKit:提供了一个结构灵活,自动版本化,RESTfulJSON存储,可选支持OpenID和OAuth ,包括OAuth Discovery. CloudKit: CloudKit provides schema-free, auto-versioned, RESTful JSON storage with optional OpenID and OAuth support, including OAuth Discovery. 这意味着OAuth 1.0安全性不依赖于签名计算的复杂性和逻辑性,而仅仅依赖于秘密密钥的机密性。 This means OAuth 1.0 security relies not on the complexity and the logic of signature computation but merely on the confidentiality of a secret key. 在OAuth 2.0授权流程中-资源所有者向客户端应用程序授权时,允许客户端访问资源所有者的资源。 During an OAuth 2.0 authorization grant flow- when the resource owner grants authorization to the client application, allowing the client to access the resource owner's resources. 如果您希望将OAuth 与正确的密码结合使用,那么越来越多的趋势是将OAuth 2.0与密码扩展一起使用。 If your desire is to use OAuth with proper cryptography, the trend is more and more to use OAuth 2.0 with cryptographic extensions. 更糟糕的是,OAuth 的某些自定义选项可能会被用在错误的地方或者实施不当,进而导致不安全的实现。 Even worse, some of the available options in OAuth can be taken in the wrong context or not enforced properly, leading to insecure implementations.
Display more examples
Results: 357 ,
Time: 0.0222