Sida Loogu Daro Login App-kaaga: Furayaasha, Magic Links, Google iyo Doorarka

Si aad login ugu darto app, dooro hab — email iyo password, magic links (link gelitaan mar keliya ah oo email lagu diro), ama “Sign in with Google” — oo hirgeli maktabad auth oo la caddeeyay ama bixiye la martigeliyay, ee ha ka bilaabin wax kasta. Kadibna go'aan ka qaad waxa nooc kasta oo isticmaale ah samayn karo (doorarka), oo ku xoojin server-ka bog kasta iyo codsi API kasta. Session-yadu waa inay isticmaalaan cookies ammaan ah, dhammaadaan, oo si sax ah u dhammaadaan markii la baxo.

Hagahan wuxuu u sii marayaa doorasho kasta iyo faahfaahinta kala saarta login shaqeeya iyo login ammaan ah. Fikradaha ka dambeeya, eeg waa maxay authentication.

Marka hore go'aan ka qaad: ma u baahan tahay login gebi ahaanba?

Login wuxuu soo kordhiyaa dhibaato iyo mas'uuliyad. Waad u baahan tahay marka:

• Isticmaalayaashu leeyihiin xog gaar ah (booking-yadooda, dukumentiyadooda, invoices-kooda)
• Isticmaalayaashu waxyaabo beddeli karaan oo dadka kale arki doonaan
• Waxaad lacag ka qaadaysaa helitaanka
• Dadka kala duwan u baahan yihiin ogolaansho kala duwan (milkiile vs shaqaale vs macmiil)

Waxaa laga yaabaa aadan u baahnaan login website marketing ah, directory dadweyne, ama foom kaliya email kuu diraya. Liiska sugitaanka ma u baahna akoonno; field email ah ayaa ku filan.

Afarta habood ee caadiga ah ee login

App badan waxay isku daraan laba: Google sign-in iyo magic links email ah waa lammaane caan ah oo daboolaya dadka badan iyada oo aan password la kaydin.

Email iyo password

Haddii aad bixiso passwords, kuwan waa shuruudo aan laga tegi karin:

• Hash-garee passwords-ka algorithm-ka hashing-ka ee gaabiska ah. Hagaha kaydinta password-yada ee OWASP wuxuu talinayaa Argon2id, iyada oo scrypt, bcrypt ama PBKDF2 ay yihiin kuwa kale. Waligaa ha kaydin passwords qoraal cad ama hash guud oo degdeg ah.
• Dib u dejinta password-ka waxay isticmaalaan link random ah oo mar keliya la isticmaali karo oo dhammaada, oo loo diro email la xaqiijiyay.
• Ha muujin emails-ka leh akoonno. “Haddii emailkaas la diiwaangeliyay, waxaan u dirnay link dib u dejin” ayaa ka wanaagsan “Akoon lama helin”.
• Xaddid isku dayga login-ka iyo dib u dejinta si loo gaabiyo male-ynta password-yada.
• Oggolow passwords-ka dheer iyo password managers; ka reeb xeerarka kuu qasbaya isku darka xarfaha aan caadiga ahayn.

Magic links iyo codes mar keliya

Magic link waa link gelitaan oo lagu diro isticmaalaha email ahaan. Riixitaankiisa wuxuu galiyaa isticmaalaha. Code mar keliya waa isla fikradda, laakiin wuxuu ku qoraan halkii la riixi lahaa.

• Links-ka iyo codes-ka waa inay degdeg u dhammaadaan oo mar keliya shaqeeyaan.
• Link-ku waa inuu galiyo isticmaalaha qalabka uu ku riixay, token-kuna waa inuusan ku sii jirin logs ama qalabka analytics-ka.
• Waxaad u baahan tahay diritaan email oo la isku halayn karo — eeg sida loo diro emails app-ka. Ku tijaabi Gmail iyo Outlook, oo hubi folders-ka spam-ka.

Sign in with Google (iyo bixiyeyaasha OAuth ee kale)

“Sign in with Google” wuxuu isticmaalaa OAuth iyo OpenID Connect: Google wuxuu xaqiijiyaa isticmaalaha yahay qofka, wuxuuna app-kaaga u sheegaa email-kiisa iyo magacaa. Dejinta, sida bishii Sebtember 2026, waxay ka dhacdaa qaybta Google Auth Platform ee Google Cloud Console:

1. Samee ama dooro mashruuc, oo buuxi bogga Branding — waxa isticmaalayaashu ku arkaan consent screen-ka (magaca app-ka, email-ka taageerada, logo).
2. Bogga Clients, samee client nooca “Web application”.
3. Ku dar authorized JavaScript origins iyo redirect URIs — ciwaanada saxda ah ee app-kaagu ku shaqeeyo iyo kuwa Google u soo celiyo isticmaalayaasha markii login dhammaado.
4. Ku kaydi client ID iyo client secret secrets-ka app-kaaga.

Waxyaabaha caadiga ah ee khaladka ku noqda, sida ku xusan dukumentiyada OAuth ee Google:

• redirect_uri_mismatch: ciwaanka redirect-ka waa inuu si sax ah u isku mid noqdaa, oo ay ku jiraan http iyo https, xarfaha weyn iyo yar iyo calaamadda slash-ka dambe. Ku dar mid u gaar ah ciwaanka preview-kaaga iyo mid u gaar ah domain-kaaga live ah.
• HTTPS waa loo baahan yahay: redirect URIs waa inay isticmaalaan HTTPS, marka laga reebo localhost inta horumarinta socoto.
• Parameter-ka state waa in la hubiyaa markii dib loo soo laabto si loo ilaaliyo cross-site request forgery. Maktabadaha wanaagsan ayaa tan kuu sameeya.

Haddii aad codsato oo keliya macluumaadka aasaasiga ah ee gelitaanka (magac, email, profile), Google wuxuu sheegay in xaqiijinta app-ka aan loo baahnayn. Codsashada helitaanka Gmail, Drive ama Calendar ee isticmaalayaasha way ka duwan tahay, waxayna u baahan tahay xaqiijin.

Samee mise isticmaal bixiye?

Labada hore labaduba waa macquul. Bixiyeyaasha la martigeliyay waxay adiga kuu maamulaan wax badan laakiin waxay ku darayaan ku xirnaan iyo mararka qaar waxay kharash ku qaadaan isticmaale firfircoon kasta; hubi qiimaha hadda jira boggeeda. Maktabadaha xogta oo dhan database-kaaga ayay ku haysaan, laakiin waxay adiga kuu tegayaan waxyaabo badan oo aad sax ahaan u habayso. Mid kasta oo aad dooratid, ka codso AI-ga inuu isticmaalo halkii uu password ama session logic-ka gacanta u qori lahaa.

Doorarka iyo ogolaanshaha

Login wuxuu kuu sheegayaa qofka yahay. Ogolaanshuhu wuxuu go'aamiyaa waxa uu samayn karo. Ku sii fududee marka hore:

Qawaanin muhiim ah oo ka muhiimsan magacyada doorarka:

• Hubi server-ka, mar kasta. Batan ku qarsanaanta bogga ma joojinayso qof kasta inuu API-ga si toos ah u wacdo.
• Ku xaddid milkiilaha. Xubin oo soo qaadaya “booking 123” waa inuu helaa kaliya haddii ay tiisa tahay.
• Isticmaaluhu ma isku kor u qaadi karo. Ka dhaaf goobaha doorka ee browser-ka ka soo diraya cusboonaysiinta profile-ka.
• Default ahaan ogolaansho la'aan. Routes-ka cusub waa inay u baahdaan login marka aanad go'aan kale qaadan.

Isku tijaabi laba akoon: mid ku soo gal, ID-ga diiwaan qor, kadibna kan kale ku soo gal oo isku day inaad furto. Liiska amniga wuxuu leeyahay tijaabada buuxda.

Amniga session-ka

Ka dib login-ka, app-ku wuxuu xasuustaa isticmaalaha session ahaan — badanaa cookie. Hagaha maareynta session-yada ee OWASP wuxuu talinayaa:

• Session cookies lagu dejiyay Secure (HTTPS oo keliya), HttpOnly (scripts-ka bogga aan akhriyi karin) iyo SameSite
• Session ID cusub oo la bixiyo markii login, iyo mar kale marka awoodaha beddelmaan
• Idle timeout iyo muddo ugu badan oo buuxda, oo server-ka lagu xoojiyay
• Logout kaas oo session-ka server-ka ku dhammeeya, ee ma aha oo keliya cookie-ga tirtira
• Session-yada la joojiyo markii isticmaaluhu beddelo password-kiisa

Kaydinta tokens-ka login-ka local storage-ka browser-ka waa caadi ku jirta tutorials-ka, laakiin waxay u soo bandhigtaa script kasta oo bogga ku socda; secure cookies badanaa waa default wanaagsan app-yada web-ka.

Prompt u daboola waxyaabaha muhiimka ah

Ku dar akoonno isticmaale app-kan. Isticmaalayaashu waxay diiwaangeli karaan oo login ku gali karaan email iyo password, ama Google. Isticmaal [library ama provider] halkii aad code auth gaar ah qori lahayd. Hash-garee passwords-ka Argon2id ama bcrypt. Ku dar dib u dejinta password-ka email-ka oo leh link mar keliya ah oo saacad dhammaada. Ku hay session-yada cookies ammaan ah oo HttpOnly ah. Ilaali /dashboard iyo route API kasta si kaliya isticmaalayaasha login ku jira ay isticmaali karaan, oo hubi in isticmaalayaashu arki karaan mashaariicdooda kaliya. Ku dar doorka “admin” oo arki kara dhammaan isticmaalayaasha; kaliya admins ayaa gaadhi kara /admin, si server-ka lagu hubiyo.

Kadibna tijaabi: diiwaangeli, ka bax, login ku gal, dib u dejii password-ka, isku day URL gaar ah markaad ka baxday, iyo isku day diiwaanka isticmaale kale.

Khaladaadka caadiga ah ee login-ka AI lagu dhisay

• Ilaalinta bogga oo keliya. Bogga ayaa u wareejiya isticmaalayaasha ka baxay, laakiin API-gu wuxuu xog siiyaa qof kasta.
• Sirta browser-ka ku jirta. OAuth client secrets iyo furayaasha maamulka bixiyaha auth waa inay ku jiraan server-ka.
• Preview iyo URL-yada live oo isku khaldan. Redirect URI-ga Google ama linkiga emailka dib u dejinta wuxuu tilmaamaa preview-ka, sidaas darteed login-ku wuu jabaa markii la daabaco.
• Ma jiro xaqiijinta email-ka. Qof kasta wuxuu isu diiwaangelin karaa qof kasta oo email-kiisu yahay anyone@company.com. Xaqiiji email-ka ka hor inta aad wax la xidhiidha ciwaankaas siiso.
• Tijaabinta waddada wanaagsan oo keliya. Isku day passwords-ka khaldan, links-ka dhammaaday iyo akoon labaad.

Ku darista login Mythex

Mythex, login isticmaalayaasha app-kaaga waa wax aad app-kaaga ku darto — waa mid ka go'an akoonkaaga Mythex. Mythex ma bixiyo alaab auth oo gudaha ah, sidaas darteed waxaad keentaa maktabad auth ama bixiye iyo furayaashiisa:

1. Dooro hab — tusaale ahaan email iyo password oo lagu kaydiyay database-kaaga, ama SDK ka bixiyaha la martigeliyay.
2. Haddii aad isticmaalayaasha kaydiso adigu, app-ku wuxuu u baahan yahay database; ka codso chat-ka ama isticmaal /database.
3. Ku dheji furayaasha bixiyaha secrets-ka mashruuca (/secrets ama settings-ka mashruuca).
4. Isticmaal prompt sida kor ku taal, kadibna ku tijaabi Preview. Google sign-in ahaan, ku dar redirect URIs labada preview-ka iyo ciwaankaaga la daabacay.

Eeg Add login to your app docs-ka. Haddii aad dhisayso alaab lacag ah, sida loo dhiso SaaS MVP waxay daboolaysaa akoonnada iyo billing-ka labadaba.

Su'aalaha