ReactLandingPage与Rails后端的安全通信？-SecurecommunicationfromReactLandingPagewithRailsBackend?

1  

I am not rails user. But as for your API, like almost all the RESTful API backend, I would assume that rails has the concept of public/private API. I would make the API for getting data from the user public, so that people can send their information without authentication and the other API routes private.

我不是rails用户。但至于你的API，就像几乎所有RESTful API后端一样，我认为rails具有公共/私有API的概念。我会创建用于从用户公开获取数据的API，以便人们可以在没有身份验证的情况下发送他们的信息，并且其他API路由是私有的。

In java spring framework, I can allow an API route to accessible by everyone, like login and generic(no private info) API routes and every other API routes are private which requires Authentication(like an auth-token).

在java spring框架中，我可以允许每个人都可以访问API路由，例如登录和通用（无私有信息）API路由，并且每个其他API路由都是私有的，需要身份验证（如auth-token）。

0  

When, you do the login flow and the user has entered the password and hit send, Once your backend authenticates the details, you would have to create an signed authorization token using maybe JWT** ( Json web token ) and send this authorization token to the front-end.

当您执行登录流程并且用户输入密码并点击发送时，一旦您的后端验证详细信息，您将不得不使用JWT **（Json Web令牌）创建签名授权令牌并将此授权令牌发送到前端。

Then, Whenever the front-end makes a call to the backend, it has to attach this token in the header before making the API call. And the back-end should de-code the token to find out which user is requesting it and if the ttl* is within the limits as the issuing token.

然后，每当前端调用后端时，它必须在进行API调用之前将此标记附加到标头中。并且后端应该对令牌进行解码以找出哪个用户正在请求它以及ttl *是否在作为发布令牌的限制内。

If both the cases pass, the back-end should send the requested data or it should send a HTTP CODE - 403/Forbidden, which should then be handled in the front-end to logout the user and open up the login page again.

如果两种情况都通过，后端应该发送请求的数据，或者它应该发送HTTP CODE-403 / Forbidden，然后应该在前端处理以注销用户并再次打开登录页面。

*(Time to live calculated based on the hours this token is valid from the time of issuing/login)

*（生效时间根据此令牌从签发/登录时起有效的小时数计算）

** JWTs are basically base-64 encoded data ( and signed with a unique key by your backend ) of the user's data. A decoded JWT token of a user would most likely look like this :

** JWT基本上是用户数据的base-64编码数据（并由后端用唯一键签名）。用户的解码JWT令牌很可能如下所示：

{ 
    userIs : "0000-aa12-bb43-cd18", 
    userName : "Some name", 
    ttl : "Time to live of this token" 
}