使用Channel API时，是否可以将token和client_id传递给客户端？

问题描述

我需要创建一个应用程序，其中GAE服务器总是只与一个客户端交谈（即一条消息总是只发送给一个客户端）。

I请执行以下操作 -

Python：

  def get（self） ：
＃在页面加载时生成令牌
 client_id = uuid.uuid4（）。hex 
 token = channel.create_channel（client_id）
 template_values = {'token'：token ，
'client_id'：client_id 
} 
 self.response.out.write（template.render（'page.html'，template_values））
 
 def post （self）：
＃回复客户
 ... 
 client_id = self.request.get（'id'）
 channel.send_message（client_id，message）
  

Javascript：

 <$ c $ b $ .ajax（{
 type：POST，
 url：/，
 data：f =+字段+& id =+{{client_ ID}}，//警告！ 
 contentType：application / x-www-form-urlencoded，
 success：function（data）{
} 
}）; 
}; 
 
 onOpened = function（）{
 connected = true; 
 sendMessage（'opened'）; 
}; 
 onMessage =函数（msg）{
 alert（msg.data）; 
}; 
 onError = function（err）{
 alert（err）; 
}; 
 onClose = function（）{
 alert（close）; 
}; 
 //打开新会话
 channel = new goog.appengine.Channel（'{{token}}'）; // 警告！ 
 socket = channel.open（）; 
 socket.onopen = onOpened; 
 socket.onmessage = onMessage; 
 socket.onerror = onError; 
 socket.onclose = onClose; 
  

效果很好，但是在这种情况下，令牌和 client_id 传递给客户端。是否可以？

解决方案

没有技术原因不这样做。如果您担心安全问题，该令牌就更有价值：可以监听流量的攻击者可以获取令牌并在不同的环境中收听渠道消息。但是我确实有一个疑问：为什么不在POST响应中返回消息，而不是通过通道发送消息？或者是示例代码只是简单的例子？

I need to create an application, where GAE server will always talk with just one client (i.e. one message should be always sent just to one client).

I do the following -

Python:

def get(self):
    # generate token, when page is loaded
    client_id = uuid.uuid4().hex
    token = channel.create_channel(client_id)
    template_values = {'token': token,
                       'client_id': client_id
                       }
    self.response.out.write(template.render('page.html', template_values))

def post(self):
    # reply to the client
    ...
    client_id = self.request.get('id')
    channel.send_message(client_id, message)

Javascript:

sendMessage = function(field) {
  $.ajax({
    type: "POST",
    url: "/",
    data: "f=" + field + "&id=" + "{{ client_id }}", // WARNING!
    contentType: "application/x-www-form-urlencoded",
    success: function(data) {
    }
  });
};

onOpened = function() {
  connected = true;
  sendMessage('opened');
};
onMessage = function(msg) {
  alert(msg.data);
};
onError = function(err) {
  alert(err);
};
onClose = function() {
  alert("close");
};
// open new session
channel = new goog.appengine.Channel('{{ token }}'); // WARNING!
socket = channel.open();
socket.onopen = onOpened;
socket.onmessage = onMessage;
socket.onerror = onError;
socket.onclose = onClose;

It works well, but with such scenario both token and client_id are passed to the client. Is it OK?

解决方案

There's no technical reason not to do this. If you're worried about security, the token is far more valuable: an attacker who could listen to your traffic could take the token and listen to channel messages in a different context. The clientid wouldn't let them do that.

But I do have a question: why not return the message in the POST response, rather than sending a message over the channel? Or is the sample code just simplified for the example?

这篇关于使用Channel API时，是否可以将token和client_id传递给客户端？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！