php否则使用方法,在PHP中使用“记住我”功能的正确方法

短

在登录系统上工作并试图实现记住我的功能.

最近,我对这个问题进行了研究,阅读了一些文章,帖子,故事,小说,童话故事(称为他们,因为他们中的一些不包含甚至1行代码,只包含一些单词),cookie漏洞如固定,劫持等

并决定实现以下目标

设置登录尝试之间的时间延迟(以防止暴力攻击)并限制尝试次数

>在几乎每个操作中重新生成会话ID

但是我真的很困惑我的主要问题：哪种方式是适当的,“记住我”功能？使用cookies /会话/数据库？

请你解释一下代码的想法(没有代码就明白了)

详细

目前,我的代码看起来像这样

在登录期间,我使用以下功能设置Cookie和会话

protected function validateUser($userid, $ckey=0, $rememmber=0) {

session_start();

session_regenerate_id(true); //this is a security measure

$_SESSION['user_id'] = $userid;

$_SESSION['HTTP_USER_AGENT'] = md5($_SERVER['HTTP_USER_AGENT']);

if (isset($remember) && $rememmber == 'on') {

setcookie("user_id", $_SESSION['user_id'], time() + 60 * 60 * 24 * COOKIE_TIME_OUT, "/");

setcookie("user_key", sha1($ckey), time() + 60 * 60 * 24 * COOKIE_TIME_OUT, "/");

}

return true;

}

然后在安全用户页面上,使用user_id检查user_id,以从db获取有关用户的所有重要数据

public function protect() {

session_start();

/* Secure against Session Hijacking by checking user agent */

if (isset($_SESSION['HTTP_USER_AGENT'])) {

if ($_SESSION['HTTP_USER_AGENT'] != md5($_SERVER['HTTP_USER_AGENT'])) {

$this->signout();

exit;

}

}

// before we allow sessions, we need to check authentication key - ckey and ctime stored in database

/* If session not set, check for cookies set by Remember me */

if (!isset($_SESSION['user_id'])) {

if (isset($_COOKIE['user_id']) && isset($_COOKIE['user_key'])) {

/* we double check cookie expiry time against stored in database */

$cookie_user_id = $_COOKIE['user_id'];

$stmt = $this->db->prepare("select `ckey`,`ctime` from `users` where `id` =?") or die($this->db->error);

$stmt->bind_param("i", $cookie_user_id) or die(htmlspecialchars($stmt->error));

$stmt->execute() or die(htmlspecialchars($stmt->error));

$stmt->bind_result($ckey, $ctime) or die($stmt->error);

$stmt->close() or die(htmlspecialchars($stmt->error));

// coookie expiry

if ((time() - $ctime) > 60 * 60 * 24 * COOKIE_TIME_OUT) {

$this->signout();

}

/* Security check with untrusted cookies - dont trust value stored in cookie.

/* We also do authentication check of the `ckey` stored in cookie matches that stored in database during login */

if (!empty($ckey) && is_numeric($_COOKIE['user_id']) && $_COOKIE['key'] == sha1($ckey)) {

session_regenerate_id(); //against session fixation attacks.

$_SESSION['user_id'] = $_COOKIE['user_id'];

$_SESSION['HTTP_USER_AGENT'] = md5($_SERVER['HTTP_USER_AGENT']);

} else {

$this->signout();

}

} else {

if ($page != 'main') {

header('Location:' . wsurl);

exit();

}

}

}