什么是防止会话劫持的最好方法？ [英] What is the best way to prevent session hijacking?

问题描述

具体来说，这是关于何时使用客户端会话Cookie来标识服务器上的会话。

是对整个网络使用SSL / HTTPS加密的最佳答案网站，你有最好的保证，没有人在中间的攻击将能够嗅探现有的客户端会话cookie？

也许第二最好使用某种对存储在会话cookie中的会话值本身进行加密？

如果恶意用户可以对机器进行物理访问，他们仍然可以查看文件系统来检索

解决方案

加密会话值将具有零效果。会话cookie已经是一个任意值，加密它只会生成另一个可以被嗅探的任意值。

唯一真正的解决方案是HTTPS。如果您不想在整个网站上执行SSL（也许您有性能问题），您可能只能使用SSL保护敏感区域。为此，首先请确保您的登录页面是HTTPS。当用户登录时，除了常规会话cookie之外，还设置一个安全cookie（意味着浏览器将只通过SSL链接传输它）。然后，当用户访问您的某个敏感区域时，将其重定向到HTTPS，并检查是否存在该安全Cookie。

编辑：这个答案最初是在2008年写的，现在是2016年了，没有理由不在整个网站上使用SSL。不再有纯文本HTTP！

Specifically this is regarding when using a client session cookie to identify a session on the server.

Is the best answer to use SSL/HTTPS encryption for the entire web site, and you have the best guarantee that no man in the middle attacks will be able to sniff an existing client session cookie?

And perhaps second best to use some sort of encryption on the session value itself that is stored in your session cookie?

If a malicious user has physical access to a machine, they can still look at the filesystem to retrieve a valid session cookie and use that to hijack a session?

解决方案

Encrypting the session value will have zero effect. The session cookie is already an arbitrary value, encrypting it will just generate another arbitrary value that can be sniffed.

The only real solution is HTTPS. If you don't want to do SSL on your whole site (maybe you have performance concerns), you might be able to get away with only SSL protecting the sensitive areas. To do that, first make sure your login page is HTTPS. When a user logs in, set a secure cookie (meaning the browser will only transmit it over an SSL link) in addition to the regular session cookie. Then, when a user visits one of your "sensitive" areas, redirect them to HTTPS, and check for the presence of that secure cookie. A real user will have it, a session hijacker will not.

EDIT: This answer was originally written in 2008. It's 2016 now, and there's no reason not to have SSL across your entire site. No more plaintext HTTP!

这篇关于什么是防止会话劫持的最好方法？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！