PHP“Session_regenerate_id”和用户身份验证 [英] PHP "Session_regenerate_id" and Authentication of users

问题描述

我在我的网站上创建了一个登录功能，并且我正在考虑在每个页面上重新生成会话ID，以使其更安全。

PHP：有关regenerate_id的信息，但PHP页面上的帖子与他们提供的有关session_regenerate_id的信息完全不同。

有人可以解释这两个问题：

• 我是否需要将旧会话数据复制到新生成的数据中，还是自动完成？代码示例非常感谢......
  
  




• 如何检查用户是否已经登录？我应该在会话变量中存储什么，以及如何？代码示例非常感谢...

谢谢

当您调用session_regenerate_id（）时，不需要复制会话数据。这一切都是由PHP为您照顾的。基本上会创建一个新的会话标记和cookie，将会话数据复制到会话存储中以与新标记相关联，并且如果将true作为单个参数传递给函数，则会删除磁盘上的旧会话数据文件。 p>

您在会话中存储的指示用户是否登录的内容取决于您。我经常只是存储一个简单的布尔值来表示它们是否已经登录，以及其他值包含用户名，名称等。然后检查是否有人登录，就像这样简单：

 <？php 
 if（$ _SESSION ['logged_in']）{
 //用户登录
} else { 
 //用户未登录
} 
？> 
  

HTH。

I am creating a login-function on my website, and I am thinking about regenerating the session ID on every page to make things more secure.

I have read PHP:s information about regenerate_id but the posts on the PHP page are quite different from the information they provide about session_regenerate_id.

Could somebody explain these two questions:

• Do I need to copy the old session data into the newly generated one, or is this done automatically? Code examples are very much appreciated...
  

• How do I check to see if a user is already logged in? What should I store in the session variable, and how? Code examples are very much appreciated...

Thanks

解决方案

Calling session_regenerate_id() on every page may be a little bit of overkill, depending on your setup. The function is used to prevent session hijacking and should be used whenever a user elevates their level of privilege (such as logging in). Usually you would switch to a https connection once a user is logged in, meaning you only need to call session_regenerate_id() once as the new cookie would be tranmitted over a secure connection and wouldn't be able to be eavesdropped. However, if you don't have a SSL certificate on your server regenerating the session cookie on every page could be a good option.

When you call session_regenerate_id() you don't need to copy session data. This is all taken care of for you by PHP. Basically a new session token and cookie are created, session data is copied in the session store to be associated with the new token, and if you pass true as the single argument to the function the old session data file on disk is deleted.

What you store in the session to indicate if a user is logged in is up to you. I often just store a simple boolean value to indicate if they're logged in, along with other values holding usernames, name, etc. Then checking if someone is logged in is as simple as this:

<?php
    if ($_SESSION['logged_in']){
        //User logged in
    } else {
       //User not logged in
    }
?>

HTH.

这篇关于PHP“Session_regenerate_id”和用户身份验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！