PHP implements single sign-on in web system_PHP tutorial

php implements single sign-on for web systems

With the ever-expanding needs of users, more systems have been built. In order to obtain a better user experience, user single sign-on needs to be implemented. The so-called single sign-on means that after a user logs in on one system, he does not need to log in repeatedly on other systems. The benefits of single sign-in are obvious, improving user experience. How to implement single sign-on, here I provide two solutions:

1. The first-level domain name is the same, achieved by sharing cookies

There are two sites a.the.com and b.the.com A and B. As long as you log in to either site A or B, you can use both sites without logging in to the other site. Through cookie-based implementation, the premise is that the two systems share the first-level domain name and the user must be uniquely identified. The first-level domain name of the above two sites is the.com. We only need to set the domain attribute of the cookie to the.com; the specific process is as follows: When the user logs in to one of the sites, a cookie information is set. Contains the identifying user ID. For security, the value of the cookie needs to be encrypted. When the user visits other websites, it first determines whether there is a cookie. If so, the cookie is decrypted, the user information is obtained, and the user is set to the logged-in status.

The following is the PHP sample code

Function login() //Normal login

　{

　…//Verify the legitimacy of the user

　$_SESSION['uid'] = $user_id;

setcookie('sign', encrypt($pass9), '', '/', 'the.com');

　}

　funtion sign()

　{

$sign = $_COOKIE['sign'];

　if(!empty($sign))

　{

　$sign = decrypt($sign);

　…………///Login successful

　}

　}

What needs to be noted here is: encryption and decryption must require security verification. However, this method is not perfect. The two sites must have the same first-level domain name; in addition, this completely cookie-based method is not secure enough.

2. Adopt a special login system.

All sites share a login system; when a user successfully logs in on one of the sites, the system calls the login interface of other sites to complete the user's login on other sites and sets the corresponding login information; or when the user logs in When the user logs in, only the user login information is saved in this system. When the user logs in at other sites, the system interface must be requested to obtain information about whether the user is logged in. The disadvantage of the former method is that no matter whether the user uses other sites, those sites need to save the user status; the latter method transfers all the pressure to the login system. If you want to realize the unified operation of user exit, you need the site to call the exit interface of the login system, and then the login system interface calls the exit interface of other sites; or set a mark to indicate the user to exit if the mark does not exist. At this time, just put Just clear the mark. If other sites find that the mark does not exist, they will know that the user has exited the system.

This processing method requires stipulating the login interface and logout interface between the login system and the individual site. Through these interfaces, a site can easily handle user login or logout:

Function login()

　{

　$info = callLoginServer(); //Access the login server

　if(!empty($info)) //Login successful

　}

// If the user is not logged in, log in to this system and call the login server interface

Function logging() //Log in to this system

　{

　....//Login successful

callSeverLogin();//Notify the user to log in

　}

The above is just a simple logical structure, and specific processing is required for a formal system.

If you have a better way, please feel free to discuss it together!