词汇表

Supabase 文档中使用的术语和缩写的定义。

🌐 Definitions for terminology and acronyms used in the Supabase documentation.

访问令牌 #

🌐 Access token

访问令牌是一个短期有效（通常不超过1小时）的令牌，用来授权客户端访问服务器上的资源。它的形式是一个 JSON Web Token (JWT)。

🌐 An access token is a short-lived (usually no more than 1 hour) token that authorizes a client to access resources on a server. It comes in the form of a JSON Web Token (JWT).

身份验证 #

🌐 Authentication

身份验证（常缩写为 authn.）是验证用户身份的过程。验证用户身份可以通过多种方式进行：

🌐 Authentication (often abbreviated authn.) is the process of verifying the identity of a user. Verification of the identity of a user can happen in multiple ways:

1. 向用户询问他们知道的东西。例如：密码、口令。
2. 检查用户是否可以访问他们拥有的东西。例如：电子邮件地址、电话号码、硬件密钥、恢复码。
3. 确认用户具有一些生物特性。例如：指纹、某种面部结构、虹膜印记。

身份验证器应用 #

🌐 Authenticator app

认证器应用会生成基于时间的一次性密码（TOTP）。这些密码是根据一个很长且难以猜测的秘密字符串生成的。这个秘密最初是通过扫描二维码传给应用的。

🌐 An authenticator app generates time-based one-time passwords (TOTPs). These passwords are generated based off a long and difficult to guess secret string. The secret is initially passed to the application by scanning a QR code.

授权 #

🌐 Authorization

授权（通常缩写为 authz.）是验证某个身份是否被允许访问资源的过程。授权通常通过验证访问令牌来进行。

🌐 Authorization (often abbreviated authz.) is the process of verifying if a certain identity is allowed to access resources. Authorization often occurs by verifying an access token.

身份提供者 #

🌐 Identity provider

身份提供者是一种软件或服务，它允许第三方应用在不交换密码的情况下识别用户。如果没有身份提供者，社交登录和企业单点登录就无法实现。

🌐 An identity provider is software or service that allows third-party applications to identify users without the exchange of passwords. Social login and enterprise single-sign on won't be possible without identity providers.

社交登录平台通常使用 OAuth 协议，而企业单点登录则基于 OIDC 或 SAML 协议。

🌐 Social login platforms typically use the OAuth protocol, while enterprise single-sign on is based on the OIDC or SAML protocols.

JSON 网页令牌 (JWT) #

🌐 JSON Web Token (JWT)

一个 JSON Web Token 是一种数据结构，以字符串形式表示，通常包含关于用户的身份和授权信息。它会编码关于其有效期的信息，并使用加密密钥进行签名，使其防篡改。

🌐 A JSON Web Token is a type of data structure, represented as a string, that usually contains identity and authorization information about a user. It encodes information about its lifetime and is signed with cryptographic key making it tamper resistant.

访问令牌是 JWT，通过查看它们包含的信息，你可以允许或拒绝对资源的访问。行级安全策略是基于 JWT 中存在的信息制定的。

🌐 Access tokens are JWTs and by inspecting the information they contain you can allow or deny access to resources. Row level security policies are based on the information present in JWTs.

JWT 签名密钥 #

🌐 JWT signing secret

Supabase 发布的 JWT 是用 HMAC-SHA256 算法签名的。用于签名的密钥叫做 JWT 签名密钥。你不应该把这个密钥分享给不信任的人或东西，也不应该公开发布它。任何有这个密钥的人都可以创建任意的 JWT。

🌐 JWTs issued by Supabase are signed using the HMAC-SHA256 algorithm. The secret key used in the signing is called the JWT signing secret. You should not share this secret with someone or some thing you don't trust, nor should you post it publicly. Anyone with access to the secret can create arbitrary JWTs.

多因素认证（MFA 或 2FA） #

🌐 Multi-factor authentication (MFA or 2FA)

多因素认证是通过使用多种因素来验证用户身份的过程：用户知道的东西、用户拥有的东西或他们自身的特性。

🌐 Multi-factor authentication is the process of authenticating a user's identity by using a combination of factors: something users know, something users have or something they are.

一次性使用 #

🌐 Nonce

Nonce 意思是一次性使用的数字。不过实际上，它是一个独特且难以猜测的字符串，用于安全地初始化某个协议或算法，或者在各种形式的重放攻击中检测滥用。

🌐 Nonce means number used once. In reality though, it is a unique and difficult to guess string used to either initialize a protocol or algorithm securely, or detect abuse in various forms of replay attacks.

OAuth#

OAuth 是一种协议，允许第三方应用向用户请求并获得授权。它通常用于实现社交登录，并且在 OIDC 协议中作为企业单点登录的基础。应用可以请求不同级别的访问权限，包括基本的用户身份信息，例如名称、电子邮件地址和用户 ID。

🌐 OAuth is a protocol allowing third-party applications to request and receive authorization from their users. It is typically used to implement social login, and serves as a base for enterprise single-sign on in the OIDC protocol. Applications can request different levels of access, including basic user identification information such as name, email address, and user ID.

开放ID连接 #

🌐 OIDC

OIDC 是 OpenID Connect 的缩写，它是一种让企业实现单点登录的协议。OIDC 基于像 OAuth 和 JSON Web Tokens 这样的现代网络技术。它通常用来代替旧的 SAML 协议。

🌐 OIDC stands for OpenID Connect and is a protocol that enables single-sign on for enterprises. OIDC is based on modern web technologies such as OAuth and JSON Web Tokens. It is commonly used instead of the older SAML protocol.

一次性密码 (OTP) #

🌐 One-time password (OTP)

一次性密码是一个短的、随机生成且难以猜测的密码或代码，它会发送到某个设备（比如电话号码）或者由设备或应用生成。

🌐 A one-time password is a short, randomly generated and difficult to guess password or code that is sent to a device (like a phone number) or generated by a device or application.

密码哈希函数 #

🌐 Password hashing function

密码哈希函数是专门设计的算法，它们允许网络服务器在不以明文存储密码的情况下验证密码。与其他通过安全随机数生成器生成的难以猜测的字符串不同，密码是由用户选择的，通常很容易被攻击者猜到。这些算法会减慢攻击速度，并让攻击者猜密码的成本变得非常高。

🌐 Password hashing functions are specially-designed algorithms that allow web servers to verify a password without storing it as-is. Unlike other difficult to guess strings generated from secure random number generators, passwords are picked by users and often are easy to guess by attackers. These algorithms slow down and make it very costly for attackers to guess passwords.

通常公认的三种密码哈希函数是：Argon2、bcrypt 和 scrypt。

🌐 There are three generally accepted password hashing functions: Argon2, bcrypt and scrypt.

密码强度 #

🌐 Password strength

密码强度是衡量一个密码有多难被猜到的指标。基本的衡量方法包括根据密码中使用的字符类型计算可能性数量。例如，仅包含字母的密码比包含字母和数字的密码变化少。更好的衡量方法包括查看密码是否与某些单词、短语或已知密码相似的策略。

🌐 Password strength is a measurement of how difficult a password is to guess. Basic measurement includes calculating the number of possibilities given the types of characters used in the password. For example a password of only letters has fewer variations than ones with letters and digits. Better measurements include strategies such as looking for similarity to words, phrases or already known passwords.

PKCE#

代码交换证明密钥（Proof Key for Code Exchange）是 OAuth 协议的一个扩展，用于在应用（网页应用、单页应用或移动应用）和授权服务器之间安全地交换刷新令牌和访问令牌。它通常用于刷新令牌和访问令牌可能被第三方截获的场景，比如在操作系统上运行的其他应用。这在移动设备上是一个常见问题，因为操作系统可能会将 URL 提供给其他应用。有时在单页应用中也可能被利用到。

🌐 Proof Key for Code Exchange is an extension to the OAuth protocol that enables secure exchange of refresh and access tokens between an application (web app, single-page app or mobile app) and the authorization server. It is used in places where the exchange of the refresh and access token may be intercepted by third parties such as other applications running in the operating system. This is a common problem on mobile devices where the operating system may hand out URLs to other applications. This can sometimes be also exploited in single-page apps too.

提供者刷新令牌 #

🌐 Provider refresh token

提供者刷新令牌是由第三方身份提供者颁发的刷新令牌，可以用来刷新返回的提供者令牌。

🌐 A provider refresh token is a refresh token issued by a third-party identity provider which can be used to refresh the provider token returned.

提供者令牌 #

🌐 Provider tokens

提供者令牌是由第三方身份提供者发出的长期有效的令牌。这些令牌由社交登录服务（例如 Google、Twitter、Apple、Microsoft）发出，用来在这些平台上唯一标识一个用户。

🌐 A provider token is a long-lived token issued by a third-party identity provider. These are issued by social login services (e.g., Google, Twitter, Apple, Microsoft) and uniquely identify a user on those platforms.

刷新令牌 #

🌐 Refresh token

刷新令牌是一个长期有效的令牌（在大多数情况下是无限期的），它通常被存储并用来换取新的刷新令牌和访问令牌，而且通常只换取一次。一旦刷新令牌被兑换，它就会失效，不能再次兑换。不过在实际操作中，刷新令牌可以在短时间内多次兑换。

🌐 A refresh token is a long-lived (in most cases with an indefinite lifetime) token that is meant to be stored and exchanged for a new refresh and access tokens only once. Once a refresh token is exchanged it becomes invalid, and can't be exchanged again. In practice, though, a refresh token can be exchanged multiple times but in a short time window.

刷新令牌流程 #

🌐 Refresh token flow

刷新令牌流程是一种机制，它会在有效的刷新令牌基础上发放新的刷新令牌和访问令牌。它用于延长应用的授权访问时间。一个持续使用的应用会在访问令牌过期之前调用刷新令牌流程。

🌐 The refresh token flow is a mechanism that issues a new refresh and access token on the basis of a valid refresh token. It is used to extend authorization access for an application. An application that is being constantly used will invoke the refresh token flow before the access token expires.

重放攻击 #

🌐 Replay attack

重放攻击是指攻击者窃取或截获敏感信息，然后尝试再次使用这些信息（因此叫重放）来破坏系统。通常，通过正确使用随机数可以减轻重放攻击的风险。

🌐 A replay attack is when sensitive information is stolen or intercepted by attackers who then attempt to use it again (thus replay) in an effort to compromise a system. Commonly replay attacks can be mitigated with the proper use of nonces.

行级别安全策略 (RLS) #

🌐 Row level security policies (RLS)

行级安全策略是 Postgres 数据库中的特殊对象，它们限制客户端可执行的操作或返回的数据。RLS 策略使用 JWT 中的信息来识别用户，以及他们被允许执行或查看的操作和数据。

🌐 Row level security policies are special objects within the Postgres database that limit the available operations or data returned to clients. RLS policies use information contained in a JWT to identify users and the actions and data they are allowed to perform or view.

SAML#

SAML代表安全断言标记语言，是一种让企业实现单点登录的协议。SAML在2000年代初被发明，基于XML技术。它是企业实现单点登录的事实标准，尽管最近更流行的OIDC（OpenID Connect）协议正逐渐受欢迎。

🌐 SAML stands for Security Assertion Markup Language and is a protocol that enables single-sign on for enterprises. SAML was invented in the early 2000s and is based on XML technology. It is the de facto standard for enabling single-sign on for enterprises, although the more recent OIDC (OpenID Connect) protocol is gaining popularity.

会议 #

🌐 Session

会话或身份验证会话是将已验证的用户身份绑定到网页浏览器的概念。会话通常是长期存在的，可以通过用户注销来终止。访问令牌和刷新令牌的组合表示浏览器中的一个会话，它们存储在本地存储或作为 cookie。

🌐 A session or authentication session is the concept that binds a verified user identity to a web browser. A session usually is long-lived, and can be terminated by the user logging out. An access and refresh token pair represent a session in the browser, and they are stored in local storage or as cookies.

单点登录 (SSO) #

🌐 Single-sign on (SSO)

单点登录允许企业集中管理账户和应用访问。他们使用身份提供商软件或服务在目录中整理员工信息，并通过 OIDC 或 SAML 协议将这些账户与应用连接起来。

🌐 Single-sign on allows enterprises to centrally manage accounts and access to applications. They use identity provider software or services to organize employee information in directories and connect those accounts with applications via OIDC or SAML protocols.

基于时间的一次性密码（TOTP） #

🌐 Time-based one-time password (TOTP)

基于时间的一次性密码是一种从一个密钥按固定时间间隔生成的一次性密码，通常来自移动设备上的应用（例如 Google Authenticator，1Password）。

🌐 A time-based one-time password is a one-time password generated at regular time intervals from a secret, usually from an application in a mobile device (e.g., Google Authenticator, 1Password).