关于已签名的Cookie而不是会话的提示 [英] Tips on signed cookies instead of sessions

问题描述

我正在考虑放弃PHP的 $ _ SESSION （即服务器端会话处理，添加一些语言无关的味道），并使用签名cookie，

I'm considering ditching PHP's $_SESSION (i.e. the server-side session handling, to add some language-agnostic flavor) and using signed cookies instead, since I've heard so much good about them (Flickr uses them, so they ought to be good enough for me too).

我理解这个技术的基本上下文：使用cookie自由地将键 - 值对从客户端传递到服务器，并对它们进行签名，以确保这些值不会被篡改。

I understand the basic context of the technique: Use cookies freely to pass key-value pairs from client to server, and sign them to make sure that the values aren't tampered with.

但是，实现签名部分？也;因为流量可能是HTTP，是否有一个很好的方法发送敏感数据（如用户的密码）与此方法，同时反对cookie窃取和/或篡改？

But what would be a good way to implement the signing part? Also; since the traffic will probably be HTTP, is there a good way to send sensitive data (such as a user's password) with this method, while working against cookie-stealing and/or tampering?

推荐答案

为什么要麻烦？

我不会对敏感数据使用这种技术。它可以与常规会话结合使用 - 您可以给客户端一个具有正常会话ID的cookie，但也包括您的应用程序在每个页面上需要的所有键/值对。这样，您可以避免为每个页面请求打开您的会话存储空间。

Why bother?

I wouldn't use this technique for sensitive data. It can be useful in combination with a regular session though - you can give the client a cookie with a normal session id, but also include all those key/value pairs that your application needs on every page. This way, you can avoid hitting your session storage for every page request.

您应该尽量保持数据量非常紧密，因为它将与每个请求一起发送

You should aim to keep the amount of data pretty tight, since it will be sent with every request.

记住这一点...

如果数据不敏感，您可以使用 sha1 从键/值对和共享密钥的组合创建的散列。例如

If the data isn't sensitive, you can sign the values with sha1 hash made from a combination of the key/value pairs and a shared secret. e.g.

$values=array(
  'user_id'=>1,
  'foo'=>'bar'
);
$secret='MySecretSalt';

$plain="";
foreach($values as $key=>$value)
{
    $plain.=$key.'|'.$value.'|';
}
$plain.=$secret;
$hash=sha1($plain);

现在给客户端一个包含所有值和哈希值的cookie。您可以在Cookie显示时检查哈希。如果根据客户端提供的值计算的哈希值与预期哈希值不匹配，则表明该值已被篡改。

Now give the client a cookie with all the values and the hash. You can check the hash when the cookie is presented. If the hash you calculate from values presented by the client doesn't match the expected hash, you know the values have been tampered with.

对于敏感数据，您需要加密值。请查看提供大量加密功能的 mcrypt 扩展程序。

For sensitive data, you'll need to encrypt the values. Check out the mcrypt extension which offers a lot of cryptographic functions.

关于Cookie窃取，如果您将用户凭据放入Cookie并信任它，那么获取该cookie的人可以模拟该用户，直到密码更改。一个好的做法是记住您如何验证用户，并且仅在用户明确登录时授予某些权限。例如，对于论坛，您可以允许某人发布，但不能更改其电子邮件地址等帐户详细信息。

With regards to cookie stealing, if you're putting user credentials into a cookie and trusting it, then someone who obtains that cookie can impersonate that user until the password is changed. A good practice is to remember how you authenticated a user, and only grant certain privileges if the user explicitly logged in. For example, for a forum you might let someone post, but not change their account details like email address.

自动登录cookie还有其他技术，涉及给这样的cookie一个令牌值，你只允许使用一次。 有关该技巧的一篇好文章。

There are other techniques for "autologin" cookies, involving giving such cookies a token value which you only allow to be used once. Here's a good article on that technique.

您还可以考虑将客户端IP包括在签名的cookie中，如果它与显示cookie的IP不匹配，则让他们再次登录。这提供了更多的保护，但不会为明显的IP地址不断变化的人工作。您可以将其设为可选功能，并为用户提供选择停用的选项。只是一个闲置的思想，我没有看到这样做在实践中：）

You could also look at including the client IP in a signed cookie, and if it doesn't match the IP presenting the cookie, you get them to log in again. This provides more protection, but won't work for people whose apparent IP address keeps changing. You could make it an optional feature, and give the user a way to opt out. Just an idle thought, I've not seen that done in practice :)

有关一个很好的文章，解释会话盗窃，劫持和固定见会话和Cookie ，其中提供了一些其他技巧，例如使用User-代理标头作为附加签名。

For a nice article which explains session theft, hijack and fixation see Sessions and Cookies which offers a few more techniques to try, such as using the User-Agent header as an additional signature.

这篇关于关于已签名的Cookie而不是会话的提示的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！