The WiFi certification project has been going on for a long time and it's felt that the authentication method itself is not very technical in its own right, but that the reliability of these external channels is high. SMS identification numbers seem to be an API call, but text messaging switches occasionally have a leaking connection, operators' access blocks, users' cell phone signals are missing the authentication code.——Any link is broken. Micromail sweep authentication is the same thing, and public platform interfaces occasionally overstay and OAuth echoes are stuck with browser compatibility problems that lead to certification failure. These issues cannot be seen from technical files; only by actually running through a large amount of real authentication traffic can we know where the problem is and how to get behind it.
The reliability of SMS is based on dual access and an over-hour retry.
First, about the number of channels. Most of them.WiFi certification systemOnly one channel was taken when the SMS gateway was connected. But this is a dangerous practice at a critical time.——If the access is rendered unusable by default, by operator restrictions or service providers themselves, all settings that rely on SMS certification are paralysed simultaneously. It is better to have access to at least two SMS providers and to switch failures automatically. Both channels are used actively in normal times, with traffic distributed as a proportion of the diversion, and one of them automatically cuts the flow to another channel when it is not available.
The two channels are not simply connecting the APIs of both service providers, and there are a few details to be addressed. One is that the templates for both channels need to be pre-screened to ensure that text messages sent in the same context are consistent and users do not receive different authentication code messages because of the channel switch. The other is that the detection mechanism for the tunnel switch cannot just see whether API calls or not.——Sometimes API calls are successful, but text messages do not actually reach them, a situation that requires service to determine the health of the channel. If the rate of delivery of a route has dropped to less than 80% in the last five minutes, it should automatically reduce the traffic weight of the corridor.
Another problem is the operator's filtering sensitive words to text messages. The template for content of authenticated text messages should be the safest in theory.——It is a digital authentication code with a short hint. But in practice, there are cases where the operator’s keyword filtering rules trigger a Chinese word that leads to failure in text messaging. These situations are very difficult to sort out, because different operators and provinces have different filter rules and do not tell you exactly what the words triggered. The response is: SMS templates are as simple as possible, do not take any non-necessary text, and prepare two alternative templates for different terms that can be quickly switched when the main template is intercepted.
The validity and re-release mechanisms for SMS are also carefully designed. The validity period is too short for the user to enter; it is too long for the user to enter; security is in danger."Reacquire"But no, only requests are allowed in 120 seconds. These parameters are not fixed by headshots and require fine-tuning of the actual data in operation.——If the average time of a regional text message is 45 seconds, the 60-second limit on re-reaction will be tight.
Micro-letter authentication docking, technology links longer than they look.
The standard process for micro-mail scanning authentication is: guests click on Portal page"Micromail Authentication", the page shows a two-dimensional code that guests scan with micromails, and the micro-letter client initiates a request to the public platform, which returns the WiFi authentication system server, completes the authentication and informs Portal to jump onto the successful page. Each step of this link may fail for various reasons.
One is the creation and presentation of a 2-dimensional code. The two-dimensional code is a picture, and if the network environment on Portal leads to a failure in loading it, the user may see a crack map or a blank area, and has no idea how to operate it. The answer is: when the 2-dimensional code fails, it shows a clear texttip."Two-dimensional loading failed. Try texting authentication"and provide a shortcut to text message authentication to avoid user cards on blank pages.
Second, we can trust the reliability of the public platform returns.——If the return reply is not received in more than five seconds, the micromail will abandon the callback. This means that the WiFi authentication system echo interface must be completed with user recognition and authentication processing within a short time frame, and cannot do much of this time-consuming operation during the feedback process. The correct approach is: the echo interface only provides the most basic user identification check, then returns to the microcard successfully after confirmation, and the actual account creation, log recording etc. are done through an astendment team at backstage.
Three are Portal pages that know how micro-side authentication works. When the micro-mail sweep is completed, Portal pages need to feel the results of the authentication in order to jump over. There are two common approaches: one is regular backstage query status on Portal pages; the other is real time notification using WebSocket. The rounding process is simple but not realistic and simultaneous rotations at peaks can create unnecessary pressures on backstage. WebSocket methods are more real-time, but there are problems with connectivity stability in some web settings. The actual programme usually uses round-trip as a base mechanism with two seconds between rounds, while WebSocket serves as an accelerated channel and WebSocket gives priority to real-time notification when available.
(c) The uniform administration of the two forms of authentication.
From a carrier perspective, SMS and micro-credit authentication are managed uniformly in the certification system, although they have achieved a different technology. The authentication records of the same user should be aggregated under the same user image, regardless of the way they come from; the reasons for the failure of authentication should be recorded centrally on the alert platform, whether it is a text message channel problem or a micromail call timeout; and the availability of authentication methods should cover both channels.
The practice common in actual projects is:WiFi certification systemI want you to introduce one into the architecture."Authentication Channel Fit Layer", which uses different authentication methods such as text messages, micro-mails, account passwords, one key authentications in abstract form as a single authentication interface. The upper business logic only interacts with this fit layer and does not need to care about the specific authentication method. The same channel adaptor is responsible for managing their connections, overtime retrying, health testing, and the upper layers require either a uniform certification success or failure result. This design significantly reduces the cost of adding an additional authentication mode and does not require changes to the top operating code.
The channel fit layer also plays an important role: when a authentication channel is not available, the user’s authentication request route can be automatically passed to other accessible channels. For example, text message gateways are completely shut and there is already a Portal page that automatically hides SMS authentication options and directs users to micromail scan authentication. This downgrading capability significantly reduces user complaints in case of large-scale failure in the authentication channel.
The technical program can do both of these mechanisms, automatic switching and health testing, but if no one is monitoring the channel’s running condition, no one regularly checks its balances, nobody cares about the expiry date of the contract for the service provider. Using the security of the access as a permanent check on daily feeder is more robust than simply relying on technology to get under control.