在非常多地方就是都出现了使用二维码登录，二维码付款，二维码账户等应用(这里的二维码种马，诈骗就不说了)，二维码验证，多终端辅助授权应用開始多起来，这里先说下啥是二维码，事实上二维码就是存了二进制数据的黑白图片，当出现要求二维码登录的时候，server会生成一条暂时的唯一的二维码信息，发送到client以二维码(图片)的形式写入到网页，然后你就会看到统一的四个方形的二维码，假设做的好这个二维码信息应该是有时效的，这里暂且不考虑这些，就简单的微信登录作为样例看看吧：

首先说下整个授权流程：

在client网页中会不断向server发送https连接，而且这里传输非常少的数据之后就断开连接了，以下看下微信网页中这个login1c709c.js文件：

(function($, _aoWin) {_aoWin.QRLogin = {};_aoWin.LoginLog = "";var _sBaseHost = "",_oLoginQrCodeImg = document.getElementById("loginQrCode");if (document.domain == "qq.com") {_sBaseHost = "weixin.qq.com";} else if(location.hostname.match(/(wechat\.com)$/)){_sBaseHost = "wechat.com";}else{_sBaseHost = "wechatapp.com";}var show_tip = 1,_sCurUUId,_oResetTimeout,_aWebMMCallbacks = [],_oDetactWebMMInterval = setInterval(function(){if(_aoWin.WebMM){clearInterval(_oDetactWebMMInterval);var callback;while(callback = _aWebMMCallbacks.shift()){if(typeof(callback) != "function") continue;callback();}}}, 1000);function _logInPage(_asLog){_aoWin.LoginLog = LoginLog + _asLog + "\n";}function _afterLoadWebMMDo(callback){if(!_aoWin.WebMM){_aWebMMCallbacks.push(callback);}else{callback();}}function _reportNow(text){_logInPage(text);_afterLoadWebMMDo(function(){WebMM.ossLog({Text: text});WebMM.flushOssLog();});}var reLoadQRImgCount = 0,loadQRCodeTime = 0,loadQRImgSucc = function(){clearInterval(loadQRImgWatchDog);_logInPage("Load QRCode Success, time=" + (new Date().getTime() - loadQRCodeTime) + "ms, reload count: " + reLoadQRImgCount);},loadQRImgFail = function(img){_reportNow("Load QRcode fail!" + status + ", src: " + img.src + ", time: " + (new Date().getTime() - loadQRCodeTime) + "ms");},loadQRImgWatchDog = null;function _loadQRImg(uuid) {_poll(uuid);_logInPage("Load QRCode Start");loadQRCodeTime = new Date().getTime();_oLoginQrCodeImg.onload = function(){loadQRImgSucc();_oLoginQrCodeImg.onload = null;};_oLoginQrCodeImg.onerror = function(){loadQRImgFail(this)};_oLoginQrCodeImg.src = "https://login."+_sBaseHost+"/qrcode/"+uuid+"?t=webwx";loadQRImgWatchDog = setInterval(function(){if (reLoadQRImgCount >= 5) {_reset();return;}reLoadQRImgCount++;var _img = new Image();_img.onload = function () {if(!_oLoginQrCodeImg.onload) return;_oLoginQrCodeImg.onload = null;_oLoginQrCodeImg.src = this.src;//replaceloadQRImgSucc();};_img.onerror = function(){loadQRImgFail(this)};_img.src = _oLoginQrCodeImg.src + "&r=" + new Date().getTime();}, 5000);}var _sSecondRequestTime = 0,_nAjaxTimeout = 100 * 1000,_nNewLoginFuncErrCount = 0;function _poll(_asUUID) {var _self = arguments.callee,_nTime = 0;_sCurUUId = _asUUID;_logInPage("_poll Request Start, time: " + new Date().getTime());_nTime = new Date().getTime();$.ajax({type: "GET",url: "https://login." + _sBaseHost + "/cgi-bin/mmwebwx-bin/login?uuid=" + _asUUID + "&tip=" + show_tip,dataType: "script",cache: false,timeout: _nAjaxTimeout,success: function(data, textStatus, jqXHR) {_logInPage("_poll Request Success, code: " + window.code + ", time: " + (new Date().getTime() - _nTime) + "ms");switch (_aoWin.code) {case 200:_sSecondRequestTime = new Date().getTime() - _sSecondRequestTime;_logInPage("Second Request Success, time: " + _sSecondRequestTime + "ms");clearTimeout(_oResetTimeout);var _fNewLoginFunc = function(){$.ajax({url: _aoWin.redirect_uri + "&fun=new",//new login pagetype: "GET",success:function(msg) {_logInPage("new func reponse, reponseMsg: " + msg);var code = msg.match(/<script>(.*)<\/script>/);var skey=msg.match(/<skey>(.*)<\/skey>/);if(code){eval(code[1]);}else{$("#container").show();$("#login_container").hide();}if(skey && skey[1]){WebMM.model("account").setSkey(skey[1]);}},error:function(jqXHR, textStatus, errorThrown){_nNewLoginFuncErrCount++;if(_nNewLoginFuncErrCount > 5){if(confirm("Call new login page func error, refresh?")){location.reload()}return;}_reportNow(_aoWin.redirect_uri + " New login page func error: " + textStatus +" retryCount:" + _nNewLoginFuncErrCount);setTimeout(_fNewLoginFunc, 500);}});};_fNewLoginFunc();_reportNow("/cgi-bin/mmwebwx-bin/login, Second Request Success, uuid: " + _asUUID + ", time: " + _sSecondRequestTime + "ms");break;case 201:clearTimeout(_oResetTimeout);show_tip = 0;$('.errorMsg').hide();$('.normlDesc').hide();$('.successMsg').show();_reportNow("/cgi-bin/mmwebwx-bin/login, First Request Success, uuid: " + _asUUID);_reportNow("/cgi-bin/mmwebwx-bin/login, Second Request Start, uuid: " + _asUUID);_sSecondRequestTime = new Date().getTime();//_nAjaxTimeout = 5 * 1000;_self(_asUUID);break;case 408:setTimeout(function(){_self(_asUUID);}, 500);break;case 400:case 500:_reset();_afterLoadWebMMDo(function(){_aoWin.Log.d("500, Login Poll Svr Exception");});break;}},error: function(jqXHR, textStatus, errorThrown) {if (textStatus == 'timeout') {setTimeout(function(){_self(_asUUID);}, 500);} else {setTimeout(function(){_self(_asUUID);}, 5000);_logInPage("_poll Request Error:" + textStatus);_afterLoadWebMMDo(function(){_aoWin.Log.e("Login Poll Error:" + textStatus);});}}});}var getUUIDCount = 0,_getUUIDWatchDog,_bGetUUIDSuccess = false;//ajax successִfunction _getUUID() {getUUIDCount++;var _self = arguments.callee,_loadError = function(errorText){_reportNow("Load UUID Error! ErrorText: " + errorText + " getUUIDCount=" + getUUIDCount);if(getUUIDCount > 5){if (confirm("Load uuid error. Refresh?")) {location.reload();}}setTimeout(function(){_self();}, 500);};clearTimeout(_getUUIDWatchDog);_getUUIDWatchDog = setTimeout(function(){if(!_aoWin.QRLogin.code){_logInPage("GetUUID Timeout, WatchDog Run");_self();}}, 10000);$.ajax({type: "GET",url: "https://login." + _sBaseHost + "/jslogin?appid=wx782c26e4c19acffb&redirect_uri="+encodeURIComponent(location.protocol+"//"+location.host+"/cgi-bin/mmwebwx-bin/webwxnewloginpage")+"&fun=new&lang=" + document.lang,dataType: "script",cache: false,success : function(){clearTimeout(_getUUIDWatchDog);if(_bGetUUIDSuccess) return;if (_aoWin.QRLogin && _aoWin.QRLogin.code == 200) {_logInPage("GetUUID Success, UUID=" + QRLogin.uuid);_bGetUUIDSuccess = true;clearTimeout(_oResetTimeout);_oResetTimeout = setTimeout(function(){location.reload();//Note: Don't run _reset(). If you run _reset(), there will may have many _poll request, as they get 408 return code}, 5 * 60 *1000);//5 mins_loadQRImg(QRLogin.uuid);} else {var QRLoginCode = (_aoWin.QRLogin && _aoWin.QRLogin.code) ? _aoWin.QRLogin.code : "None";_logInPage("GetUUID Error, QRLogin.code=" + QRLoginCode);_loadError("QRLogin.code= "  + QRLoginCode);}},error : function(xhr, textStatus, errorThrown){_logInPage("GetUUID Error, textStatus=" + textStatus);_loadError(textStatus);}});}function _reset(){location.reload();}if ($("#login_container").is(":visible") ) {_getUUID();}var _bHadLog = false;function _ossLog() {if (_bHadLog) return;_bHadLog = true;var _sUvid = document.cookie.match(new RegExp( "(^| )"+"webwxuvid"+"=([^;]*)(;|$)"));if(!_sUvid || _sUvid.length < 3) return;_sUvid = _sUvid[2];(new Image()).src = "/cgi-bin/mmwebwx-bin/webwxstatreport?funkey=indexdemo&uvid="+_sUvid+"&uuid="+_sCurUUId;}if($("img.guide").length > 0) {var _nTimer = 0,_oGuide$ = $(".guide"),_oGuideTrigger$ = $("#guideTrigger, #tipTrigger"),_oMask$ = $(".mask");function _back() {_nTimer = setTimeout(function() {_oMask$.stop().animate({opacity:0}, function(){$(".mask").hide()});_oGuide$.stop().animate({marginLeft:"-120px",opacity:0}, "400", "swing",function(){_oGuide$.hide();});}, 100);}/*guide*/_oGuide$.css({"left":"50%", "opacity":0});_oGuideTrigger$.css({"backgroundColor":"white", "opacity":"0"});_oGuideTrigger$.mouseover(function(){clearTimeout(_nTimer);_oMask$.show().stop().animate({"opacity":0.2});_oGuide$.css("display", "block").stop().animate({marginLeft:"+168px", opacity:1}, 900, "swing", function() {_oGuide$.animate({marginLeft:"+153px"}, 300);});_ossLog();}).mouseout(_back);_oGuide$.mouseover(function(){clearTimeout(_nTimer);}).mouseout(_back);}
})(jQuery, window);

细读js之后，你就会从网页client这边看到请求登录的一面，网页client每隔500毫秒就向server发起ssl请求，请求当前的二维码是否被其它client(手机)授权，假设返回结果是201，就是说明已经获取扫描二维码终端同样的账号登录授权，假设是其它情况就再隔500毫秒再循环发请求。这个过程会一直持续到二维码被扫描通过或者二维码超时(失效)为止。

当中使用的工具有： 抓包工具 Fidller ，Chrome F12开发者工具，注意偶然的发现，微信的client有一个min-webmm1cba21.js ，当中清晰可见的XSS filter规范， 这对于那些喜欢白盒測试XSS的鸽子又有希望拿Q仔了！！！