这是实现“记住我”的合理方式吗？ 功能性
如果用户登录网站并说“记住我”，我们就会获取该用户的唯一标识符，使用 RijndaelManaged 对其进行加密，密钥大小为 256，并将其放置在 httponly cookie 中，设置有效期为 120 天。 ，每次成功向服务器请求都会刷新过期时间。
我们可以选择根据用户代理和部分 ipv4 地址（最后两个八位字节）生成初始化向量。
显然，这里没有内置真正的过期系统，从技术上讲，用户可以永远使用这个加密密钥（假设我们不更改服务器端密钥）。
我考虑了这样一个事实：为了允许此功能，我需要允许用户能够绕过登录并给我他们唯一的ID（这是一个guid），我认为单独的guid真的很难猜测真正的用户guid，但会使网站容易受到生成guid的僵尸程序的攻击（我没有知道他们找到一个合法的 GUID 是多么现实）.. 所以这就是为什么服务器知道加密密钥的加密方式，并且可选地 iv 特定于浏览器和 ip 部分。
我是否应该考虑采用不同的方法，其中服务器发出与用户关联的票证，并且这些票证具有已知的到期日期，以便服务器保持对到期的控制？ 我真的应该关心过期吗？ 记住我到底是记住我吗？
期待被谦卑;), 干杯。
If a user logs into the site, and says 'remember me', we get the unique identifier for the user, encrypt this with RijndaelManaged with a keysize of 256 and place this in a httponly cookie with a set expiration of say.. 120 days, the expiration is refreshed each successful request to the server.
Optionally we generate the initialization vector based upon the user agent and part of the ipv4 address (the last two octets).
Obviously theres no real expiration system built into this, the user could technically use this encrypted key forever (given we don't change the server side key)..
I considered the fact that to allow this feature I need to allow the user to be able to bypass the login and give me their unique id (which is a guid), I figured the guid alone was really hard to guess a real users guid, but would leave the site open to attack by botnots generating guids (I've no idea how realistic it is for them to find a legit guid).. so this is why theres encryption where the server knows the encryption key, and optionally the iv is specific to the browser and ip part.
Should I be considering a different approach where the server issues tickets associated to a user, and these tickets would have a known expiration date so the server stays in control of expiration? should I really care about expiration? remember me is remember me after all?
Looking forward to being humbled ;),
Cheers.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
非常相似的问题。
您的解决方案问题在这篇博客文章中
正如 Jacco 在评论中所说：有关安全身份验证的深入信息，请阅读 网站身份验证权威指南。
Very similar question.
The solution to your question is in this blog post
As Jacco says in the comments: for in depth info about secure authentication read The Definitive Guide To Website Authentication.
您是否考虑过类似 Open Id 之类的东西？ 正如SO所使用的那样。
Did you consider something like Open Id? As SO uses.
被记住的信息有多重要？ 如果不是非常个人或重要的内容，只需将 GUID 放入 cookie 中即可。
在计算中包含 IP 地址可能是一个坏主意，因为它会让使用公共网络的用户立即被遗忘。
使用暴力来查找 GUID 是荒谬的，因为有 2128 种可能性。
How important is the information that is being remembered? If it's not going to be anything very personal or important, just put a GUID in the cookie.
Including the IP address in the calculation is probably a bad idea, as it would make users using public networks be instantly forgotten.
Using brute force to find GUIDs is ridiculous, as there are 2128 possibilities.