Sina SSO login process analysis
Recently studied the login process of Sina CAS and found that in fact, Sina's sso implements yale-CAS and adds a little bit of new things. The basic authentication process interaction process remains unchanged. Its originality is the implementation of Ajax single sign-in, which is quite awesome. The implementation principle is iframe+javaScript callback function.
1. Junior SSO
Basic SSO is to realize unified login under the same top-level domain name by planting the cookie of the top-level domain name. For example:
Single sign-on address: sso.xxx.com/login.jsp
Application 1: web1.xxx.com/login.jsp
Application 2: web2.xxx.com/login.jsp
Application 3 : web3.xxx.com/login.jsp
Login process:
Situation 1: (The user has never logged in)
1, The user accesses web1.xxx.com/login.jsp, and web1 redirects to sso.xxx. com/login.jsp
2, User input verification, successful. sso.xxx.com implants the tokenid of the .xxx.com domain cookie and redirects to web1.xxx.com/login.jsp. web1.xxx.com accesses the tokenid of the .xxx.com domain cookie to determine that it has been logged in, and the system logs in Finish.
Situation 2: (The user has already logged in) Log in directly.
Second, Sina SSO
Sina realizes unified login across domain names, which is essentially based on Cookie. If the user disables cookies, they will not be able to log in anyway. For example: The Sina SSO server is login.sina.com.cn/sso/login.php
, and the Weibo login address is weibo.com/login.php. Login across first-level domain names is achieved through callback functions and iframes.
Details of the authentication process: Here we only introduce users who have never logged in.
1, The user enters weibo.com/login.php
2, The user enters the user name. After the input is completed, when the focus of the user name input box is lost, the page number sends a request to the server login.sina.com.cn/sso/prelogin.php through ajax, and the parameter is user (the user name just entered). The service returns server time and nonce authentication, which are written into javascript variables through the callback function.
3. The user enters the password, clicks to log in, and the page POST request (note that it is an ajax request, not sent by login.php),
login.sina.com.cn/sso/login.php?client=ssologin.js (v1.3.12), the page initiated by the request is an invisible iframe page in weibo.com/login.php, and the parameters are the server time and nonce obtained in the second step, the user name and the encrypted password. Return to the planted cookie tgt under login.sina.com.cn. At the same time, modify the iframe address to weibo.com/ajaxlogin.php?ticket=XXXXXX. Note that ticket is very important. This is the user's login and service credentials.
4, iframe visits weibo.com/ajaxlogin.php?ticket=XXXXXX, the user logs in, and returns a cookie planted under .weibo.com to record the user's login information.
5. Visit weibo.com/login.php again through js. Because the cookie has been written and the login is successful, the server sends 302 and redirects to the user's home page. Weibo.com/userid .
6, At this point, the login process is completed.
Focus: Analysis of interaction process and password encryption algorithm.
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
AI Hentai Generator
Generate AI Hentai for free.
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1378
52
How to use PHP to implement efficient and stable SSO single sign-on
Oct 15, 2023 pm 02:49 PM
How to use PHP to achieve efficient and stable SSO single sign-on Introduction: With the popularity of Internet applications, users are faced with a large number of registration and login processes. In order to improve user experience and reduce user registration and login intervals, many websites and applications have begun to adopt single sign-on (Single Sign-On, referred to as SSO) technology. This article will introduce how to use PHP to implement efficient and stable SSO single sign-on and provide specific code examples. 1. SSO single sign-on principle SSO single sign-on is an identity authentication solution
OAuth in PHP: Building a multi-platform SSO solution
Jul 28, 2023 pm 09:38 PM
OAuth in PHP: Building a Multi-Platform SSO Solution With the rapid development of the Internet, it has become the norm for people to use various applications in multiple platforms. This brings up a question: How to implement single sign-on (SSO) between different platforms? OAuth (Open Authorization) has become an excellent choice to solve this problem. OAuth is an open standard that allows users to authorize third-party applications to access their Internet resources without sharing their credentials. OAuth can be used to build a multi-
Discuss the security and vulnerability prevention of PHP SSO single sign-on
Oct 15, 2023 pm 02:36 PM
Security and vulnerability prevention of PHPSSO single sign-on 1. Introduction With the development of the Internet, more and more websites have implemented user authentication functions. However, users need to enter their account number and password every time they log in to different websites, which is inconvenient and easy to forget. In order to solve this problem, Single Sign-On (SSO) came into being. SSO is a solution for user identity authentication on multiple websites. Users only need to log in once to achieve seamless access to other websites. 2. PH
Let's talk about how to implement single sign-on (SSO) based on Node
Dec 06, 2022 pm 07:49 PM
What is single sign-on? What is the principle? How to achieve it? The following article will take you through single sign-on and talk about how to use Node to implement single sign-on SSO. I hope it will be helpful to you!
Design practice of SSO single sign-on system based on Swoole
Jun 14, 2023 pm 04:08 PM
With the rapid development of the Internet, more and more websites and applications need to implement user single sign-on (Single Sign-On, SSO) functions to provide a more convenient and secure user experience. In this context, the SSO single sign-on system based on Swoole has gradually become a hot topic in the industry. This article will introduce how to design and implement a SSO single sign-on system based on Swoole. 1. SSO single sign-on system design idea The purpose of the SSO single sign-on system is to enable users to log in to a system.
Latest best practices for Java JAAS
Feb 23, 2024 pm 10:52 PM
1. JAAS Overview JavaJAAS (JavaAuthenticationandAuthorizationService) is a framework for multi-system single sign-on (SSO) integration, role-based access control (RBAC) and authorization management. JAAS allows applications to protect access to data or resources and define access control mechanisms. 2. The latest best practices of JAAS 1. Use JAAS for authentication JAAS provides two main authentication methods: Token-based authentication: This method uses tokens (for example, username and password) to verify user identity. Certification-based authentication: This method uses certification (for example, a digital certificate) to verify the user's identity. 2
Practical application cases of PHP SSO single sign-on in multi-system integration
Oct 15, 2023 am 11:45 AM
Practical application cases of PHPSSO single sign-on in multi-system integration Introduction: With the rapid development of the Internet and the growth of user needs, more and more websites and applications need to implement user single sign-on (SSO) functions. As a widely used server-side scripting language, PHP is flexible, simple and easy to integrate, making it the first choice of many developers. This article will introduce a PHP-based single sign-on solution and demonstrate its application in multi-system integration through practical cases. 1. What is single sign-on?
In-depth understanding of the working principle and technical mechanism of PHP SSO single sign-on
Oct 15, 2023 am 09:19 AM
Deeply understand the working principle and technical mechanism of PHPSSO single sign-on. With the rapid development of the Internet, the number of various websites and applications is also increasing. In order to access different websites and applications, users need to register different accounts and passwords respectively, which brings inconvenience and annoyance to users. In order to solve this problem, Single Sign-On (SSO) came into being. SSO is an authorization and authentication system that allows users to seamlessly access multiple systems after they successfully log in. This article will provide an in-depth understanding of P
