ajax - Ajax calls and security

Question

I've created a php function that acts like a "router", meaning that it receives Ajax calls with some variables, loads the proper method and functions and then returns the data so that JS can handle it.

Most of the functions I'm making available use $_SESSION variables that are not passed through the call/response process, so in general terms without having the proper session loaded nothing should be returned. But as far as I know, I'm sure there must be a way around this, and, more importantly, I might have left out some function that will work even without any session loaded.

So I was wondering how to restrict access to the session. One way I thought would be to pass through the ajax call the user id, or some other unique identifier, and then compare it with the session, and proceed only if the two match.

But doing so would expose the user id, which, if possible, I would prefer to keep hidden as much as I can. And, in addition, I'm not even so sure that it would block any fraudulent ajax call.

So I was wondering, is there a better way?

Thank's!

PS for what matters, I'm making the calls with jQuery

Answer 1

保护会话数据的最佳方法是使用仅存储在服务器上的密钥对其进行加密。每次您获得会话数据时都将其解密，进行所需的任何更改并对其进行加密，然后再将其放回$_SESSION. 只要客户端没有加密密钥，他们就无法解密数据（默认情况下，这些数据将存储在客户端的 cookie 中）。

如果恶意客户端尝试发送他们自己创建或修改的会话数据，则无法使用您的密钥解密（因为它未加密或使用不同的密钥加密），因此您可以假设会话数据无效并将其清除。

有关 PHP 加密的更多信息，请参阅此问题。