ck防止黑客修改其他用户数据(密码,昵称等)
1:每次登陆时,生成CK并保存在服务器端(以后每次登陆都能生成新的CK)
$userinfo['ck'] = $this->__genenal_ck($user['userid'], $user['nickname'], $user['email'], $user['stat'], $userinfo['ssourl'], $code);
2:如果黑客修改了登录接口 用户名,密码,昵称,ip进行模仿用户登录时,CK一定验证不过!
$info['ip'] = $this->ip;
$info['logintime'] = time();
$info['uid'] = $userid;
$info['nickname'] = $nickname;
$info['email'] = $email;
$info['stat'] = $stat;
$info['ssourl'] = $ssourl;
$info['auth_key'] = $this->auth_key;
$info['ck'] = md5(ICIBA_PRIVATE_KEY . serialize($info) . rand(1000000, 9999999));
//默认30天内到期
$this->memcache_ck_init();
$result = $this->memcacheck->set("sso_ck_" . $info['ck'], serialize($info), 86400 * CK_EXPIRE_DATE);
1:每次登陆时,生成CK并保存在服务器端(以后每次登陆都能生成新的CK)
$userinfo['ck'] = $this->__genenal_ck($user['userid'], $user['nickname'], $user['email'], $user['stat'], $userinfo['ssourl'], $code);
2:如果黑客修改了登录接口 用户名,密码,昵称,ip进行模仿用户登录时,CK一定验证不过!
$info['ip'] = $this->ip;
$info['logintime'] = time();
$info['uid'] = $userid;
$info['nickname'] = $nickname;
$info['email'] = $email;
$info['stat'] = $stat;
$info['ssourl'] = $ssourl;
$info['auth_key'] = $this->auth_key;
$info['ck'] = md5(ICIBA_PRIVATE_KEY . serialize($info) . rand(1000000, 9999999));
//默认30天内到期
$this->memcache_ck_init();
$result = $this->memcacheck->set("sso_ck_" . $info['ck'], serialize($info), 86400 * CK_EXPIRE_DATE);