blocks|key|375454|text|据我所知，Guid.NewGuid()应该足够了。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|375455|entityMap^0|5|E|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

As far as I can tell <code>Guid.NewGuid()</code> should be sufficient.

blocks|key|826732|text|如果您使用GUID解决方案，则始终可以通过查询数据库来确保它是唯一的。如果它不是唯一的，只需生成一个新的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|826733|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

If you go with the GUID solution - you can always make sure it is unique by querying the database. If it isn't unique - just generate a new one.

blocks|key|790542|text|使用salt、用户名和电子邮件地址创建字符串。然后从该字符串生成一个散列(MD5或SHA1)。salt可以是用户it，也可以是其他的东西，只要用户不知道。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|790543|GUID很好，但在这种情况下可能有点过分。你会有数十亿的用户吗？你大概可以用一个1到1,000,000之间的随机数过活。然后确保在x次失败尝试之后禁用登录，其中x介于3和6之间。|790544|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Make a string out of a salt, the username, and the email address. Then make a hash (MD5 or SHA1) from that string. The salt can simply be userid, or it could be something else, as long as it isn't known to the user.

GUID is fine but it's probably overkill in this situation. Are you going to have billions of users? You could probably get by with a random number between 1 and 1,000,000. Then make sure you disable login after x number of failed attempts, where x is between 3 and 6.

blocks|key|790565|text|取决于应用程序的大小和用户数，除非您知道如何处理Guid，否则Guid可能不是最好的选择。我经常看到这些字符串被用作字符串，这只会增加您的存储需求并减慢您的比较例程。要对匹配的guid进行字符串比较，必须扫描所有36个字符。对数据的过度使用，它只是存储在十六进制格式。更好的方法是将GUID保存为integers...you数组，减少搜索，同时减少存储需求。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|790566|如果您只有几千条记录，那么guid作为字符串可能不会有多大影响。但是，如果你的编程规模很大，而且规模很大，那么现在适当的调整就可以省去以后再做的痛苦了。|790567|如果要对表进行联接，则使用整数标识来执行连接，而不是guid+(基于前面提到的相同原因)。|790568|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

Depending on the size of your application and the number of users a Guid may not be the best choice unless you know how to handle them. Most often I have seen these used as strings, which only increases your storage requirement and slows down your comparison routines. A string comparison of a guid on a match has to scan all 36 characters. Way overkill for data which is just stored in hex format. Its better to save the GUID as an array of integers...you reduce the search while at the same time reducing the storage requirements.

If you only have a few thousand records, then guid as string is probably not going to matter much. But if your programming for scale, and that scale is large, then proper adjustments now will save you the pain of doing it later.

IF you are doing joins on tables, use an integer identity to do the join, not the guid (for the same reasons already mentioned).

blocks|key|368718|text|典型的身份验证包括身份(名称)和秘密(密码)。您正在设计一个仅基于一个秘密的身份验证方案。密码(以guid的形式)。这种方法的问题.(不将标识与密码分开)是指如果密码被泄露，用户无法更改密码，因为密码是他们的身份。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|368719|Maps+API密钥和类似的密钥是另一回事:它们是由服务提供者签名的声明。例如，应用程序调用Maps+API的注册域。Generate密钥接受您提交的域，将使用服务的私钥对该域名进行签名，并向您提供公开签名。在访问API时，您必须出示您已签署并同意服务条款的签名(+API密钥)。验证的另一部分(您的应用程序正在运行的域，换句话说，'claim')是由JavaScript自动检测的。|368720|我绝不是地图API方面的专家，我可能已经完成了一些部分，但这通常是如何实现的。我建议不要使用guid作为混淆的应用程序ID，因为它并没有提供太多的价值:泄漏的guid可以被任何人使用，而且您不能使用guid验证任何声明。想一想你想要保护什么，或者只是选择一个既定的方案，比如OpenId之类的。|368721|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|I|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|J|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|G|$]]

Typical authentication consists on an identity (a name) and a secret (a password). You are designing an authentication scheme consisting on only a secret, ie. the password (in form of a guid). The problem with this approach (ie. not separating identity from password) is that the user cannot change the password if compromised, because the password is their identity.

What Maps API key and similar keys are something else: they are claims signed by the service provider. For example the registered domain from where your app is calling the Maps API. The Generate key accepts a domain you submit, will sign that domain name with a private key of the service and present you with the publis signature. When accessing the API you must present the signature (the API key) that prooves you have signed up and agreed to the terms of service. The other part of the verification (the domain your app is running from, in other words the 'claim') is detected automatically by JavaScript.

I'm by no means an expert on Maps API and I may had got some parts off, but this is typically how things are implemented. I would suggest against using a guid as an obfuscated application ID as it doesn't provide much value: a leaked guid can be used by anybody and you cannot verify any claim using a guid. Think about what are you trying to protect, or just go with an established scheme like OpenId or something.

I am creating a web service to allow application developers (A.K.A. My friends) to query my database. The thing is, as a security constraint I want to be able to track each user. I am in the process of creating a unique app ID like in FaceBook or Google maps.

The developer must submit a username and email address, and when they click generate a unique key will be generated. The thing is, the database must first be checked if the user/email already exists and also check if the key is already generated (pseudo-random generation protection).

To use the webservice the user will have to enter something like:

<blockquote>
 webservice.Authenticate('app key here');
</blockquote>

to authenticate. Thanks in advance.

Unique Application Key

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我正在创建一个web服务，允许应用程序开发人员(A.K.A.我的朋友)查询我的数据库。问题是，作为一个安全约束，我希望能够跟踪每个用户。我正在创建一个独特的应用程序ID，就像在FaceBook或谷歌地图中一样。开发人员必须提交用户名和电子邮件地址，当他们单击generate时，将生成一个唯一的密钥。问题是，如果用户/电子邮件已经存在，首先必须检查数据库，还必须检查密钥是否已经生成(伪随机生成保护)

问唯一应用键
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问唯一应用键EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问唯一应用键
EN