在vue+springboot前后端分离项目中,用户在页面登录后,把从后端获取的用户菜单权限等数据存入localstarage中(使用F12键之后,可以直接修改、删除localstarage中的数据),感觉不安全的样子,有什么方式可以解决吗?请大佬们指教,谢谢~
您好,我是有问必答小助手,您的问题已经有小伙伴解答了,您看下是否解决,可以追评进行沟通哦~
如果有您比较满意的答案 / 帮您提供解决思路的答案,可以点击【采纳】按钮,给回答的小伙伴一些鼓励哦~~
ps:问答VIP仅需29元,即可享受5次/月 有问必答服务,了解详情>>>https://vip.csdn.net/askvip?utm_source=1146287632
存在localstorage里是可行的;因为只要经过用户授权 aes加密后就行了。所有的数据都应该是呈现给用户的。
业务校验不应该交给前端来做。
阿里云盘的用户授权后呈现的信息 就是存在localstorage里的。
{"pds_login_result":{"role":"user","userData":{"DingDingRobotUrl":"https://oapi.dingtalk.com/robot/send?access_token=0b4a936d0e98c08608cd99f693393c18fa905aa0868215485a28497501916fec","EncourageDesc":"内测期间有效反馈前10名用户将获得终身免费会员","FeedBackSwitch":true,"FollowingDesc":"34848372","ding_ding_robot_url":"https://oapi.dingtalk.com/robot/send?access_token=0b4a936d0e98c08608cd99f693393c18fa905aa0868215485a28497501916fec","encourage_desc":"内测期间有效反馈前10名用户将获得终身免费会员","feed_back_switch":true,"following_desc":"34848372","share":"6003c007a5d13614837e4e5fb98acae99d66e6d0"},"isFirstLogin":false,"needLink":false,"loginType":"qrCodeLogin","nickName":"","needRpVerify":false,"avatar":"","accessToken":"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOiJkNmQ3NTRiOGNiNmY0YzA2YjE3ZDg4ZTI1ZGIyNmQzMCIsImN1c3RvbUpzb24iOiJ7XCJjbGllbnRJZFwiOlwiY2xpZW50X2lkX2Zvcl9ha1wiLFwiZG9tYWluSWRcIjpcImJqMjlcIixcInNjb3BlXCI6W1wiVVNFUi5BTExcIixcIkRSSVZFLkFMTFwiLFwiU0hBUkUuQUxMXCIsXCJGSUxFLkFMTFwiLFwiU1RPUkFHRUZJTEUuQUxMXCIsXCJTVE9SQUdFLkFMTFwiLFwiQkFUQ0hcIixcIkFDQ09VTlQuQUxMXCIsXCJPQVVUSC5BTExcIixcIklNQUdFLkFMTFwiLFwiSU5WSVRFLkFMTFwiLFwiVFJBREUuQUxMXCIsXCJERVZJQ0UuQUxMXCJdLFwicm9sZVwiOlwidXNlclwifSIsImV4cCI6MTYxMDg4ODg5NSwiaWF0IjoxNjEwODgxNjM1fQ.khU5LWWJbvApEXvnWNHQKAZTlVf82iNnj707wR5nZ4IX1PLCXYfXW-KiNTJgSssW6rxmbTr9gxbDWrONzgm2ULC3q4zRuRQp9J-8lBss5noHFtAxAzoOnOzqLHatJtnkklmSJ5x5WBh5jiHCImA5-Om8NlZU_xV8xAGqV5Hizaw","userName":"180***250","userId":"d6d754b8cb6f4c06b17d88e25db26d30","defaultDriveId":"1046848","existLink":[],"expiresIn":7200,"expireTime":"2021-01-17T13:08:15Z","requestId":"2B13E368-E75E-4F99-AF77-2632631AB546","dataPinSetup":false,"state":"","tokenType":"Bearer","dataPinSaved":false,"refreshToken":"114350cdca104b78a666e812a57c7968"}}
这是之前取到的token
安全性是机制。而不是存储手段实现的。