Single Sign On SSO (Single Sign On) simply means that in a multi-system coexistence environment, after users log in in one place, they do not need to log in in other systems, that is A user's single login can be trusted by all other systems. Single sign-on is used very frequently in large websites, such as websites like Alibaba. Behind the website are hundreds or thousands of subsystems. A user's operation or transaction may involve the collaboration of dozens of subsystems. If each operation All subsystems require user authentication. Not only will the user go crazy, but each subsystem will also go crazy due to the logic of repeated authentication and authorization. In the final analysis, implementing single sign-on is to solve how to generate and store that trust, and then how other systems verify the validity of this trust. Therefore, the key points are as follows: Storing trust and verifying trust. As long as the above problems are solved, we have reached the beginning. The effect can be said to be SSO. The simplest way to implement SSO is to use cookies. The implementation process is as follows: Two commonly used web single sign-on SSO implementation principles But people will immediately question two issues: Cookies are not secure and cannot be used to avoid cross-domain login. The first issue is usually solved by encrypting cookies. The second issue is a flaw. In fact, the idea of ????this solution is to This trust relationship is stored on the client. To achieve this, you do not necessarily have to use cookies. You can also use flash. The Shared Object API of flash provides storage capabilities. Generally speaking, large systems will adopt the method of storing trust relationships on the server side. The implementation process is as follows: Two commonly used web single sign-on SSO implementation principles. The above solution is to store trust relationships in a separate SSO system (for the time being). Call it that), it is said that it is simply moved from the client to the server, but several of the problems need to be solved: how to efficiently store a large amount of temporary trust data, how to prevent the information transfer process from being tampered, how to make the SSO system trust login For the first problem, systems and binding systems can generally adopt a distributed cache solution similar to memcached, which can not only provide a mechanism for scalable data volume, but also provide efficient access. For the second question, the digital signature method is generally adopted, either through digital certificate signing or through a method like md5. This requires the SSO system to encrypt the parameters that need to be verified with md5 when returning the login URL, and bring the token. Return together. When the system that needs to be logged in finally verifies the trust relationship, the token needs to be passed to the SSO system. The SSO system can identify whether the information has been modified by verifying the token. The last problem can be solved through a whitelist. To put it simply, only systems on the whitelist can request production trust relationships. Similarly, only systems on the whitelist can be exempted from login. Through the evolution of the second solution, websso login can be implemented by issuing tickets: two commonly used web single sign-on SSO implementation principles. Through the third method, the client only issues and obtains tickets, and does not involve user information. Transmission, user information can be handed over to the subsystem and the SSO system for processing, which more effectively protects user privacy. The above only provides some simple implementation technologies, but it needs to be emphasized that this is just a technical implementation, just to solve some of the problems mentioned above. SSO itself is not high-tech, and it is more beneficial to us to have this understanding. Explore SSO in depth