PHP Session 安全

在stackoverflow上看到关于 php Session 安全的讨论，特记录之。（http://stackoverflow.com/questions/328/php-session-security）


1.使用SSL


2.重设session_id

[quote]PHP中可以：session_regenerate_id(true);[/quote]


3.设置session有效时间

可以参考鸟哥的文章：http://www.laruence.com/2012/01/10/2469.html


4.不是全局变量


5.存储信息在服务器上，不发送重要信息到cookie上


6.检查用户user_agent和IP
[quote]
PHP 使用：if ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT']

|| $_SESSION['user_ip'] != $_SERVER['REMOTE_ADDR']) {

//Something fishy is going on here?

}[/quote]


7.设置 httpOnly 避免 Session 攻击

参考：http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html


8.Lock down access to the sessions on the file system or use custom session handling
[quote]可是自定义session session_set_save_handler()
将session存储在DB, memcached等[/quote]

9.For sensitive operations consider requiring logged in users to provide their authenication details again