浅谈session,token和cookie的区别与联系

前阵子纠结了很久这三样东西的关系,最近大约的确是理顺了,现在写这篇帖子,若是以后忘记了可以及时查阅。

历史遗留问题

这三样东西的出现都是因为某种历史遗留问题,即:HTTP是无状态协议。在很早以前,查阅网站功能还不如现在丰富,所以每次建立连接后就是一个新的HTTP,服务器也不需要记住用户信息,反正用户看完就直接关掉了。

但是随着技术的发展,越来越多的网上服务兴起,如电商等平台,他们需要记住用户的信息,一遍区分开不同用户,因此就需要一个标记符号来进行区分,这就是最早的session(字面意思:维持一个会话)。

而session,token和cookie(大体上)都是与维持会话这个功能息息相关的。

Session

session从字面意思上来说就是会话,它的作用就是维持会话。打个比方说,当你和别人聊天的时候,要有一些诸如声音,口音之类的特征来辨别你在和谁对话,而session就是我们服务器手动添加的一个特征。

session会被服务器生成,并被存储在服务器本地。并通过HTTP中的set-cookie字段以key-value对的形式发给客户。每次客户进行访问的时候,将自己的session发给服务器,服务器将其与本地信息进行比对,便可以知道是哪个用户在对其进行访问了。

通常情况下,用户断开连接后session就会销毁。

并且,随着用户数量的发展,许多厂商进行了负载均衡部署,这时候,如果session只存在一个服务器里面,就很容易出现用户突然无法登录的情况,如果存在所有的服务器上,则会消耗大量的资源(况且就算只有一个服务器,在用户多的情况下,服务器也会存储大量的用户信息资源,造成极大浪费)。

Token

为了解决上述问题,Token被引入了。类似于许多其他的验证机制,Token会对用户信息进行一个散列(类似的还有各种数字签名),并将散列后的值,通过HTTP的set-cookies字段传给客户,客户存在自己本地,而服务器不需要进行任何存储。

由于单向散列函数基本上无法逆推(虽然存在很小的哈希碰撞的可能性),所有这种方法是较为安全的。

每次用户发起请求的时候,都会把cookie中的token以key-value的形式发给服务器,服务器会根据用户信息,再次进行一次散列计算,并与用户发来的信息进行比对。如果比对成功,则说明用户是本人;若比对失败,则说明信息被篡改,用户不能登录。

Cookie

cookie就是一种用于辨别用户身份的文本文件,通常被存储在客户本地,上文的Session和Token都是通过cookie的方式储存在用户本地并实现验证的。

点赞
  1. Eric Jones说道:
    Opera Windows 8.1
    My name’s Eric and I just found your site lele233.tech. It’s got a lot going for it, but here’s an idea to make it even MORE effective. Talk With Web Visitor – CLICK HERE https://talkwithwebvisitors.com for a live demo now. Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It signals you the moment they let you know they’re interested – so that you can talk to that lead while they’re literally looking over your site. And once you’ve captured their phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation… and if they don’t take you up on your offer then, you can follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship. CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business. The difference between contacting someone within 5 minutes versus a half-hour means you could be converting up to 100X more leads today! Eric PS: Studies show that 70% of a site’s visitors disappear and are gone forever after just a moment. Don’t keep losing them. Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling. You have customers waiting to talk with you right now… don’t keep them waiting. CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now. If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=lele233.tech
  2. Eric Jones说道:
    Opera Windows 8.1
    Hi, my name is Eric and I’m betting you’d like your website lele233.tech to generate more leads. Here’s how: Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It signals you as soon as they say they’re interested – so that you can talk to that lead while they’re still there at lele233.tech. Talk With Web Visitor – CLICK HERE http://talkwithcustomer.com for a live demo now. And now that you’ve got their phone number, our new SMS Text With Lead feature enables you to start a text (SMS) conversation – answer questions, provide more info, and close a deal that way. If they don’t take you up on your offer then, just follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship. CLICK HERE http://talkwithcustomer.com to discover what Talk With Web Visitor can do for your business. The difference between contacting someone within 5 minutes versus a half-hour means you could be converting up to 100X more leads today! Try Talk With Web Visitor and get more leads now. Eric PS: The studies show 7 out of 10 visitors don’t hang around – you can’t afford to lose them! Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling. You have customers waiting to talk with you right now… don’t keep them waiting. CLICK HERE http://talkwithcustomer.com to try Talk With Web Visitor now. If you'd like to unsubscribe click here http://talkwithcustomer.com/unsubscribe.aspx?d=lele233.tech
  3. Eric Jones说道:
    Opera Windows 8.1
    My name’s Eric and I just found your site lele233.tech. It’s got a lot going for it, but here’s an idea to make it even MORE effective. Talk With Web Visitor – CLICK HERE https://talkwithwebvisitors.com for a live demo now. Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It signals you the moment they let you know they’re interested – so that you can talk to that lead while they’re literally looking over your site. And once you’ve captured their phone number, with our new SMS Text With Lead feature, you can automatically start a text (SMS) conversation… and if they don’t take you up on your offer then, you can follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship. CLICK HERE https://talkwithwebvisitors.com to discover what Talk With Web Visitor can do for your business. The difference between contacting someone within 5 minutes versus a half-hour means you could be converting up to 100X more leads today! Eric PS: Studies show that 70% of a site’s visitors disappear and are gone forever after just a moment. Don’t keep losing them. Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling. You have customers waiting to talk with you right now… don’t keep them waiting. CLICK HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now. If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=lele233.tech
  4. Eric Jones说道:
    Opera Windows 8.1
    Hi, my name is Eric and I’m betting you’d like your website lele233.tech to generate more leads. Here’s how: Talk With Web Visitor is a software widget that’s works on your site, ready to capture any visitor’s Name, Email address and Phone Number. It signals you as soon as they say they’re interested – so that you can talk to that lead while they’re still there at lele233.tech. Talk With Web Visitor – CLICK HERE http://talkwithcustomer.com for a live demo now. And now that you’ve got their phone number, our new SMS Text With Lead feature enables you to start a text (SMS) conversation – answer questions, provide more info, and close a deal that way. If they don’t take you up on your offer then, just follow up with text messages for new offers, content links, even just “how you doing?” notes to build a relationship. CLICK HERE http://talkwithcustomer.com to discover what Talk With Web Visitor can do for your business. The difference between contacting someone within 5 minutes versus a half-hour means you could be converting up to 100X more leads today! Try Talk With Web Visitor and get more leads now. Eric PS: The studies show 7 out of 10 visitors don’t hang around – you can’t afford to lose them! Talk With Web Visitor offers a FREE 14 days trial – and it even includes International Long Distance Calling. You have customers waiting to talk with you right now… don’t keep them waiting. CLICK HERE http://talkwithcustomer.com to try Talk With Web Visitor now. If you'd like to unsubscribe click here http://talkwithcustomer.com/unsubscribe.aspx?d=lele233.tech
  5. Eric Jones说道:
    Opera Windows 8.1
    My name’s Eric and I just came across your website - lele233.tech - in the search results. Here’s what that means to me… Your SEO’s working. You’re getting eyeballs – mine at least. Your content’s pretty good, wouldn’t change a thing. BUT… Eyeballs don’t pay the bills. CUSTOMERS do. And studies show that 7 out of 10 visitors to a site like lele233.tech will drop by, take a gander, and then head for the hills without doing anything else. It’s like they never were even there. You can fix this. You can make it super-simple for them to raise their hand, say, “okay, let’s talk” without requiring them to even pull their cell phone from their pocket… thanks to Talk With Web Visitor. Talk With Web Visitor is a software widget that sits on your site, ready and waiting to capture any visitor’s Name, Email address and Phone Number. It lets you know immediately – so you can talk to that lead immediately… without delay… BEFORE they head for those hills. CLICK HERE https://talkwithwebvisitors.com to try out a Live Demo with Talk With Web Visitor now to see exactly how it works. Now it’s also true that when reaching out to hot leads, you MUST act fast – the difference between contacting someone within 5 minutes versus 30 minutes later is huge – like 100 times better! That’s what makes our new SMS Text With Lead feature so powerful… you’ve got their phone number, so now you can start a text message (SMS) conversation with them… so even if they don’t take you up on your offer right away, you continue to text them new offers, new content, and new reasons to do business with you. This could change everything for you and your business. CLICK HERE https://talkwithwebvisitors.com to learn more about everything Talk With Web Visitor can do and start turing eyeballs into money. Eric PS: Talk With Web Visitor offers a FREE 14 days trial – you could be converting up to 100x more leads immediately! It even includes International Long Distance Calling. Paying customers are out there waiting. Starting connecting today by CLICKING HERE https://talkwithwebvisitors.com to try Talk With Web Visitor now. If you'd like to unsubscribe click here http://talkwithwebvisitors.com/unsubscribe.aspx?d=lele233.tech

发表评论

电子邮件地址不会被公开。必填项已用 * 标注