我正在用 PHP 创建一个登录系统，我想知道如何最好地保护我的 cookie 中的用户信息字符串。我正在考虑以某种方式用密钥加密字符串？这是最好的方法吗？我对此有点陌生。
提前致谢。
问问题
2833 次
5 回答
23
Don't store sensitive information in cookies. Store a session ID hash to connect the logged in user with their account.
于 2010-06-21T15:01:10.923 回答
4
Aaron Harun has the right answer for you. There's basically no need to encrypt such data as long as you store it in a session, because that data never reaches the client/browser/user, as it is all server-side. When you create a session on PHP, it handles the cookie stuff for you, so you don't have to worry about that. In most cases, there is no need to deal with cookies. In security, dealing with cookies is detrimental.
I've seen some sloppy sites that actually store the username in a hidden field on a form, which allows anybody to simply edit their local copy of that form and take actions as whichever user they like. This seems like an obvious problem, but cookies are no better.
If you truly think it's a good idea to design a homebrew authentication system, you need to design the database first. Don't store plaintext passwords, store a hash instead (like md5, sha-1, etc) and at that point there's no harm in generating a salt for each password (a random string that you append to the user's password before hashing it, and store that salt with the password hash because you'll need it later--this prevents dictionary hash attacks, ie rainbow tables).
于 2010-06-25T14:45:35.920 回答
2
您绝不应将安全信息存储在 cookie 中。Cookie 以文本格式保存在用户计算机上，有很多理由说明您永远不应在其中存储敏感信息：
- Cookie 基本上是文本文件，计算机上的任何人都可以使用任何文本编辑器打开它。
- cookie 存储在用户计算机上，这意味着他没有时间限制，没有连接限制，没有处理限制，因此他可以尝试尽可能多地暴力破解任何数据，而不必担心 ip 被禁止/踢.. .
您应该只存储诸如要记住的用户名或会话 ID 之类的东西。
于 2010-06-21T15:51:27.773 回答
0
您可以免费获得会话！那是存储在服务器端的数据，由 PHP/您选择的框架自动处理。您只需将数据放入会话中，该会话与存储在客户端会话中的随机 UID 相关联。在客户端，这是会话 cookie。此 ID 是自动生成的，您可以细化行为manually。
客户端存储的数据永远不安全，没有可用的真正加密。无论如何，您都需要会话来跟踪登录用户。如果您有大量数据，您可以使用 ID 来识别来自其他数据存储（DB、XML 等）的关联数据
于 2010-06-25T16:31:04.107 回答