블로거 게시물을 어떻게 암호로 보호합니까?

Question

나는이 질문을 여러 번 보았습니다. 단지 여기에 있지 않습니다. 이 지점에 대한 답변은 모두 자바 스크립트에서 사용 자격 증명을 사용하도록되어 있습니다 (그리고 우리 모두는 클라이언트 측 자격 증명이 인증을 할 수있는 방법이 아님을 알고 있습니다).

시나리오는 내 블로그에서 특정 페이지를 제어하려고합니다 시간을 내가 모든 사람에게 풀어주었습니다. 내 자신의 도메인을 가지고 있으므로 PHP 스크립트를 호스팅 할 수 있습니다. 이미 Blogger의 리더 필터를 사용해 보았습니다. Gmail 계정이없는 시청자에게는 실제 고통이 있습니다.

Answer 1

내 솔루션 (자바 스크립트 사용 - 클라이언트에서는 비밀번호가없는 사용자)이 있습니다. 그것은 해킹입니다 -하지만 나는 잡을 다른 물고기가 있고 먹기 전에 갈 마일. 그것의 서버 측

<?php 
    $cookieName = 'my_auth_cookie'; 
    $loggedInCookieVal = $_COOKIE[$cookieName]; 

    if (!isset($loggedInCookieVal)) 
    { 
      $loggedInCookieVal = $_GET[$cookieName]; // was it passed in instead of coming through the Cookie channel? 
    } 

    // if $loggedInCookieVal is set, decrypt it and pull username + pwd from it - if succeeds, set $cookieValsDecrypted 
    // otherwise see if the user just sent them back in response to a challenge 

    // these are empty before login - and set in response to the challenge 
    $curUser = $_SERVER['PHP_AUTH_USER']; 
    $curPswd = $_SERVER['PHP_AUTH_PW']; 

    if (!$cookieValsDecrypted && (!isset($curUser) || !isset($curPswd))) 
    { 
     // ask the user to authenticate (again if have to) 

     header('WWW-Authenticate: Basic realm="YOUR.DOMAIN.COM"'); 
     header('HTTP/1.0 401 Unauthorized'); 

     echo "You gotta login bud - but you canceled instead"; 

     exit; 

    } else { 

     // check $curUser and $curPswd against a db or .htpasswd file, etc - or check $cookieValsDecrypted 

     // if all good then send the file 
     if ($matched) 
     { 
      switch($_GET['p']) 
      { 
       case 'login': // just came here to login - now done, go on to the real page that pulls the value 
        header('Location: http://YOUR2.DOMAIN.COM/p/page.html'); 
       break; 

       case 'page1': 
        echo file_get_contents ('./page1.txt'); // show the date 
       break; 
      } 
     } else { 
      // else send the auth request again 
      header('WWW-Authenticate: Basic realm="YOUR.DOMAIN.COM"'); 
      header('HTTP/1.0 401 Unauthorized'); 

      echo "Try something else, maybe"; 
     } 
    } 
?> 

지금 YOUR.DOMAIN.COM

의

<script type="text/javascript" src="http://YOUR.DOMAIN.COM/scripts/jquery-1.8.3.min.js"></script> 
<script type='text/javascript'> 
var $pageUrl = "http://YOUR.DOMAIN.COM/manager.php?p=page1"; // so cool how you could setup your own domain! 

function doInitStuff() 
{ 
    if ($alreadyInited) return; 
    $alreadyInited = true; 
    // a little hack - because though I said share cookies among (*) ".DOMAIN.COM" it wasn't getting sent 
    // although it's obviously there since we get it here on YOUR2.DOMAIN.COM (originally set on YOUR.DOMAIN.COM) 
    $cookies = document.cookie; 

    $result = $.ajax 
    ({ 
     type: "GET", 
     url: $pageUrl, 
     dataType: 'json', // or whatever 
     async: false, // force this to complete before moving on (should be quick though - since already logged in) 
     // username: 'username', // would get these from a prompt/html form - but should have already gone directly to the site to authenticate 
     // password: 'password', // did it that way, because wasn't able to get the u/p to be properly sent... this new way is better anyway 
     data: $cookies, // send along the cookies - they should show up in $_GET 
     success: function (result, status, jqXHR){ 
      // good - but for some reason wasn't getting result - just move on... 
     }, 
     error: function(){ 
      // not good 
     } 
    }); 

    if ($result.status == 200) 
    { 
     // insert our data into our nice Div 
     $('#realpageinfo').html($result.responseText); 
    } 

    // grrrrrr. ie strikes again! use iframes instead 
    var isMSIE = eval("/*@cc_on!@*/!1"); 
    if ($('#realpageinfo').html() == '' || isMSIE) 
    { 
     //$('#realpageinfo').replaceWith("<div id='realpageinfo' style='font-weight:bold;color:red'>Internet Explorer? Sorry, but please use a different Browser.</div>"); 
     $('#realpageinfo').replaceWith("<div id='realpageinfo'><iframe id='realpageframe' style='width:100%;height:700px' src='" + $pageUrl + "'></iframe></div>"); 
    } 
} 

// Don't mind this - multiple ways to ensure the main worker function is called 
var $alreadyInited = false; 
$(document).ready(function() { doInitStuff(); }); 
window.addEventListener('DOMContentLoaded',function() { doInitStuff(); }); 

</script> 

<div id='realpageinfo'></div> 

을 인스턴스를 대체 할 돌보는 -

The initial page call is this: 
    http://YOUR.DOMAIN.COM/manager.php?p=login 
That prompts for the username and password 
     - ala this: http://www.php.net/manual/en/features.http-auth.php 
After login some encryption is done on an authentication cookie 
     - ala this: http://php.net/manual/en/function.mcrypt-decrypt.php 
     - or this: http://php.net/manual/en/function.openssl-decrypt.php 
The cookie is set 
     - ala this: http://www.php.net/manual/en/function.setcookie.php 
And then the php file calls this present page via the following 
     - header('Location: http://YOUR2.DOMAIN.COM/p/page.html'); 
* YOUR2.DOMAIN.COM points to blogger; the page is this file here which will grab the file data and insert it into a div on the page 
     - see info here: http://support.google.com/blogger/bin/static.py?hl=en&ts=1233381&page=ts.cs 
Based on the param and confirming that the cookie is valid, manager.php gets the real file data and sends it out 
     - ala this: http://php.net/manual/en/function.file-get-contents.php 

은 그냥 빈 블로거 페이지에 다음 드롭 ... 자유롭게 개선 할 수 있습니다. 여기에 실제 적용됩니다. ClyntonCaines.Com