php - Passing data from php session vertiable to ajax (with some jQuery in between)

Question

I want to pass the user id and username stored in the session variable in php with an ajax request.

I know that i can print the values to the html of the page as a hidden text box, or as a jQuery data value, but i feel that this is not secure and that the user can make changes to the value and the ajax call will send that value which would make it in-secure. Please let me know how professionals handle this problem...

Thanks in advance!

Answer 1

专业人员通过仔细筛选所有输入、强制执行强密码标准（以便用户无法猜测其他用户的密码）以及将凭据存储在页面上的代码中而不是使用随机生成的会话令牌来映射来处理这个问题用户在服务器上的身份令牌。

通过绕过您的所有客户端代码，客户可以轻松地发送他们想要的任何数据。您必须假设客户端是邪恶的，并从这个角度考虑保护您的服务器。

编辑：

如果您在令牌及其使用方面需要一些帮助，这个问题可能会对您有所帮助：PHP cookies and member security

如果您是安全新手，我强烈推荐Web Application Hacker's Handbook。我读过它，它读起来非常透彻和有趣。

还有一本名为Web Application Defender's Cookbook的新书，看起来很有前途，虽然我还没有读过。