Authentication Solutions

身份驗證方案比較與實作流程。

Session & Cookie

  sequenceDiagram
    participant C as Client
    participant S as Server

    C ->> S: User Login {username, password}
    S ->> S: Create and Store Session in Server Memory
    S ->> C: Set-Cookie: session-id=1234567
    C ->> S: GET /user/data Cookie: session-id=1234567
    S ->> S: Compare session-id with stored data
    S ->> C: Response with user data

OAuth 2.0

詳細協定說明請參考 OAuth 2.0 協定。

  sequenceDiagram
    participant RO as Resource Owner(User)
    participant Client
    participant RS as Resource Server
    participant AS as Authorization Server

    RO->>Client: 點擊「登入 Google」
    Client->>AS: 重定向至 Google 授權頁面
    RO->>AS: 授權應用程式訪問 Google 資源
    AS->>RO: 返回授權碼(grant code)
    Client->>RS: 發送授權碼至 Backend Server
    RS->>AS: 使用授權碼請求 Access Token
    AS->>RS: 返回 Access Token 和 Refresh Token
    RS->>RS: 使用 Access Token 訪問 Google 資源
    RS->>Client: 回應處理結果
    Client->>RO: 顯示結果給使用者

JWT

Passkeys

Passkeys 是基於 FIDO2 標準的無密碼驗證方案。

驗證器類型

Platform Authenticators（內建於裝置）：

• TouchID / FaceID
• Windows Hello
• 手機內建驗證器

Roaming Authenticators（外部裝置）：

• USB 安全金鑰
• NFC
• Bluetooth

Attestation（建立 Passkey）

  sequenceDiagram
    participant U as User
    participant A as Authenticator
    participant C as Client
    participant S as Server

    U --> C: Click Register
    C ->> S: Get challenge
    S ->> S: Create challenge [87cnN44C..]
    S -->> C: Return challenge
    C ->> A: credentials.create(challenge)
    A -->> U: Request verification
    U ->> U: Biometric / PIN
    U ->> A: Verified
    A ->> A: Create Keypair, Sign challenge
    A ->> A: Store private key
    A ->> C: [challenge✅, ID, public key]
    C ->> S: Send public key and signed challenge
    S ->> S: Verify signature, Store public key
    S -->> C: Passkey Created

Assertion（使用 Passkey 登入）

  sequenceDiagram
    participant U as User
    participant A as Authenticator
    participant C as Client
    participant S as Server

    U ->> C: Sign in with passkey
    C ->> S: Get challenge
    S ->> S: Create challenge
    S -->> C: [87cnN44C..]
    C --> A: credentials.get(challenge)
    A --> U: Request verification
    U ->> U: Biometric / PIN
    U ->> A: Verified
    A ->> A: Sign challenge
    A -->> C: [challenge✅, credential ID, Username]
    C ->> S: [challenge✅, credential ID, Username]
    S ->> S: Verify with public key

驗證方案比較

Basic Authentication

Token-Based Authentication

Session Authentication

API Key Authentication

OAuth 2.0

OpenID Connect (OIDC)

Multi-Factor Authentication (MFA)

Biometric Authentication

Passkey

相關主題

• OAuth 2.0 協定
• API Security