在stackoverflow上看到关于 php Session 安全的讨论,特记录之。(http://stackoverflow.com/questions/328/php-session-security)
1.使用SSL
2.重设session_id
[quote]PHP中可以:session_regenerate_id(true);[/quote]
3.设置session有效时间
可以参考鸟哥的文章:http://www.laruence.com/2012/01/10/2469.html
4.不是全局变量
5.存储信息在服务器上,不发送重要信息到cookie上
6.检查用户user_agent和IP
[quote]
PHP 使用:if ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT']
|| $_SESSION['user_ip'] != $_SERVER['REMOTE_ADDR']) {
//Something fishy is going on here?
}[/quote]
7.设置 httpOnly 避免 Session 攻击
参考:http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html
8.Lock down access to the sessions on the file system or use custom session handling
[quote]可是自定义session session_set_save_handler()
将session存储在DB, memcached等[/quote]
9.For sensitive operations consider requiring logged in users to provide their authenication details again
1.使用SSL
2.重设session_id
[quote]PHP中可以:session_regenerate_id(true);[/quote]
3.设置session有效时间
可以参考鸟哥的文章:http://www.laruence.com/2012/01/10/2469.html
4.不是全局变量
5.存储信息在服务器上,不发送重要信息到cookie上
6.检查用户user_agent和IP
[quote]
PHP 使用:if ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT']
|| $_SESSION['user_ip'] != $_SERVER['REMOTE_ADDR']) {
//Something fishy is going on here?
}[/quote]
7.设置 httpOnly 避免 Session 攻击
参考:http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html
8.Lock down access to the sessions on the file system or use custom session handling
[quote]可是自定义session session_set_save_handler()
将session存储在DB, memcached等[/quote]
9.For sensitive operations consider requiring logged in users to provide their authenication details again