挨踢民工日志

JS高级技巧：规范、函数、类、包、事件和错误处理

fool2fish 发表于 2012.05.16

今天给公司的同事做了一场JS培训，推荐一下给新手。

主要是里面的demo质量不错，由浅及深，前后相互有关联。直观的代码对于概念的理解比较有帮助。

完整的demo请访问：http://fool2fish.aliapp.com/js-senior-skill/index.html

Js高级技巧

View more presentations from fool2fish.

ps：要负责的准备一次培训真是累死人

分类：前端开发 | 2条评论 »

RFC 6265: HTTP State Management Mechanism

fool2fish 发表于 2012.05.11

说明：未对原文进行通篇翻译，基础部分可参考 JS 权威指南，本文翻译了关于 cookie 不常用但重要的一些内容，包括浏览器端和服务器端。

原文：http://tools.ietf.org/html/rfc6265

隐私和安全

For historical reasons, cookies contain a number of security and privacy infelicities. For example, a server can indicate that a given cookie is intended for “secure” connections, but the Secure attribute does not provide integrity in the presence of an active network attacker. Similarly, cookies for a given host are shared across all the ports on that host, even though the usual “same-origin policy” used by web browsers isolates content retrieved via different ports.

由于历史原因，cookie 有一些安全和隐私问题。例如服务器可以指定一个 cookie 标记为安全连接的，但 Secure 属性并不能保证避免网络攻击的发生。同样的，cookie 被同一个主机的所有端口所共享，即使是通过使用了“同源测略”的web浏览器从不同端口获得的独立内容。

Cookies rely upon the Domain Name System (DNS) for security. If the DNS is partially or fully compromised, the cookie protocol might fail to provide the security properties required by applications.

cookie 的安全性是建立在 DNS 上的。如果 DNS部分或者完全遭到破坏（译者注：比如host文件被篡改），那么 cookie 协议将无法为应用提供所需要的安全保护。

服务器和客户端对 cookie 的处理

Origin servers MAY send a Set-Cookie response header with any response. User agents MAY ignore Set-Cookie headers contained in responses with 100-level status codes but MUST process Set-Cookie headers contained in other responses (including responses with 400- and 500-level status codes).

服务器可以在任意返回头中添加 Set-Cookie 头域。当返回状态码是10x的时候，用户代理可以忽略 Set-Cookie 头域，但其他返回情况必须处理（包括返回状态码是 40x 和 50x 的情况）。

When a user agent receives a Set-Cookie header field in an HTTP response, the user agent MAY ignore the Set-Cookie header field in its entirety. For example, the user agent might wish to block responses to “third-party” requests from setting cookies (see Section 7.1).

当从一个 HTTP 响应接收到 Set-Cookie 头域时，用户代理可以忽略其实体中的该头域。例如，用户代理可能会阻止“第三方”请求响应设置的 cookie。

多 cookie 头

An origin server can include multiple Set-Cookie header fields in a single response. The presence of a Cookie or a Set-Cookie header field does not preclude HTTP caches from storing and reusing a response.

服务器可以在一个响应中包含多个 Set-Cookie 头域。Cookie 或者 Set-Cookie 头域的存在并不妨碍 HTTP 缓存的存储和重用。

Origin servers SHOULD NOT fold multiple Set-Cookie header fields into a single header field. The usual mechanism for folding HTTP headers fields (i.e., as defined in [RFC2616]) might change the semantics of the Set-Cookie header field because the %x2C (“,”) character is used by Set-Cookie in a way that conflicts with such folding.

服务器不应该把多个 Set-Cookie 头域的值合并到一个头域中。常用的 HTTP 头域合并机制可能改变 Set-Cookie 头域的语义，因为英文逗号(译者注：头域合并的分隔符)在合并的 Set-Cookie 中可能会冲突(译者注：cookie 的值本身可能包含英文逗号)。

cookie 编码

To maximize compatibility with user agents, servers that wish to store arbitrary data in a cookie-value SHOULD encode that data, for example, using Base64。

为了最大化用户代理和服务器的兼容性，任何被存储为 cookie 值的数据都应该被编码，例如 Base64（译者注：目前通行用 encodeComponentURI 编码）.

HttpOnly Cookie

The HttpOnly attribute limits the scope of the cookie to HTTP requests. In particular, the attribute instructs the user agent to omit the cookie when providing access to cookies via “non-HTTP” APIs (such as a web browser API that exposes cookies to scripts).

Note that the HttpOnly attribute is independent of the Secure attribute: a cookie can have both the HttpOnly and the Secure attribute.

HttpOnly 属性限制了 cookie 对 HTTP 请求的作用范围。特别的，该属性指示用户代理忽略那些通过“非 HTTP” 方式对 cookie 的访问（比如浏览器暴露给js的接口）。

注意 HttpOnly 属性和 Secure 属性相互独立：一个 cookie 既可以是 HttpOnly 的也可以有 Secure 属性。

第三方 Cookie

Particularly worrisome are so-called “third-party” cookies. In rendering an HTML document, a user agent often requests resources from other servers (such as advertising networks). These third-party servers can use cookies to track the user even if the user never visits the server directly. For example, if a user visits a site that contains content from a third party and then later visits another site that contains content from the same third party, the third party can track the user between the two sites.

第三方 cookie 让人感到特别不安。当渲染一个 HTML 文档时，用户代理经常从其他服务器请求一些资源（比如广告站点）。这些第三方的服务器可以使用 cookie 来追踪用户行为，即便这些用户从未直接访问过该服务。例如，例如用户访问了一个包含第三方资源的站点，然后又访问了一个包含同一个第三方资源的站点，那么这个第三方就可以追踪到用户在这两个站点的行为。

Some user agents restrict how third-party cookies behave. For example, some of these user agents refuse to send the Cookie header in third-party requests. Others refuse to process the Set-Cookie header in responses to third-party requests. User agents vary widely in their third-party cookie policies. This document grants user agents wide latitude to experiment with third-party cookie policies that balance the privacy and compatibility needs of their users. However, this document does not endorse any particular third-party cookie policy.

某些用户代码限制了第三方 cookie 的行为。例如，有些用户代理拒绝在第三方请求中加入 cookie 头。有些则拒绝处理第三方请求返回中的 Set-Cookie 头域。用户代理对于如何处理第三方 cookie 的策略差异炯然。本文档允许用户代理进行多种第三方 cookie 策略尝试以平衡其用户对隐私和兼容性的需求。

Third-party cookie blocking policies are often ineffective at achieving their privacy goals if servers attempt to work around their restrictions to track users. In particular, two collaborating servers can often track users without using cookies at all by injecting identifying information into dynamic URLs.

如果服务器尝试绕过这个约束来追踪用户时，第三方 cookie 阻止策略常常不能满足用户对隐私的需求。特别的，两个合作的服务器不需要使用cookie，而可以通过动态的在URL中注入标记信息来追踪用户。

其他参考

wiki：http://en.wikipedia.org/wiki/HTTP_cookie#cite_note-httponlyrfc-13

中文wiki：http://www.webryan.net/2011/08/wiki-of-http-cookie/

标签：cookie, http, http 状态管理机制, rfc 6265

分类：选择性翻译 | 2条评论 »

2010-D2关键词-嘉宾访谈部分

fool2fish 发表于 2010.12.18

架构