HTTP authentication All In One

HTTP authentication All In One

Authorization and Proxy-Authorization headers

Authorization: <type> <credentials>
Proxy-Authorization: <type> <credentials>

Authentication schemes

HTTP authentication schemes

Basic ✅
See RFC 7617, base64-encoded credentials. More information below.

Bearer ✅
See RFC 6750, bearer tokens to access OAuth 2.0-protected resources

Digest ✅
See RFC 7616. Firefox 93 and later support the SHA-256 algorithm. Previous versions only support MD5 hashing (not recommended).

HOBA
See RFC 7486, Section 3, HTTP Origin-Bound Authentication, digital-signature-based

Mutual
See RFC 8120

Negotiate / NTLM
See RFC4599

VAPID
See RFC 8292

SCRAM
See RFC 7804

AWS4-HMAC-SHA256
See AWS docs. This scheme is used for AWS3 server authentication.

Schemes can differ in security strength and in their availability in client or server software.

The "Basic" authentication scheme offers very poor security, but is widely supported and easy to set up.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication#authentication_schemes

IANA

https://www.iana.org/assignments/http-authschemes

demos

Nest.js Guard

import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common';
import type { Request } from 'express';
import { Observable } from 'rxjs';

@Injectable()
export class ProfilesGuard implements CanActivate {
  canActivate(
    context: ExecutionContext,
  ): boolean | Promise<boolean> | Observable<boolean> {
    // const request = context.switchToHttp().getRequest();
    const request = context.switchToHttp().getRequest<Request>();
    console.log(`ProfilesGuard request: ${request?.toString()}`);
    // console.log(`ProfilesGuard request.method: ${request?.method}`);
    // console.log(`ProfilesGuard request.url: ${request?.url}`);
    // console.log(`ProfilesGuard request.body: ${JSON.stringify(request?.body)}`);
    // console.log(`ProfilesGuard request.params: ${JSON.stringify(request?.params)}`);
    // console.log(`ProfilesGuard request.query: ${JSON.stringify(request?.query)}`);
    // HTTP/1.1 403 Forbidden ✅
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/403
    // return false;
    // HTTP/1.1 201 Created ✅
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/201
    return true;
    // authorization 授权 微服务，用于注册授权
    // https://developer.mozilla.org/en-US/search?q=authorization
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Authorization
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Proxy-Authorization
    // authentication 身份验证 微服务，用于登录识别
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication
    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/WWW-Authenticate
    // return authenticate(request);
  }
}

(🐞 反爬虫测试！打击盗版⚠️）如果你看到这个信息, 说明这是一篇剽窃的文章，请访问 https://www.cnblogs.com/xgqfrms/ 查看原创文章！

OAuth 2.0 ✅

https://oauth.net/2/

https://datatracker.ietf.org/wg/oauth/about/

OAuth 2.0 Playground

https://www.oauth.com/playground/

OAuth 2.1 ❓

https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1

refs

https://www.cnblogs.com/xgqfrms/p/11393381.html

https://www.cnblogs.com/xgqfrms/p/13652398.html

---

---

©xgqfrms 2012-2021

www.cnblogs.com/xgqfrms 发布文章使用：只允许注册用户才可以访问！

原创文章，版权所有©️xgqfrms, 禁止转载 🈲️，侵权必究⚠️！

---