确保会话安全
我知道 SO 传统上并不是这样使用的（或者也许是这样），但我一直在学习 Web 应用程序安全性，并且认为听到 SO 专家对本文的看法会很好并且令人鼓舞（我是现在阅读它，它是关于会话安全的）。
http://carsonified.com/blog/dev/how-to -create-bulletproof-sessions/
也许我们可以进行某种讨论，指出作者错误/忘记的内容以及有哪些更好的做法？
例如，当涉及到诸如 sql 注入之类的不同安全主题时，许多人推荐诸如 mysql_real_escape_strings 之类的东西，但专家会告诉您没有什么比准备好的语句更好的了。从评论来看，这篇文章似乎有问题，所以我想知道他的内容到底好坏到什么程度。
I know SO isn't traditionally used this way (or maybe it is), but I've been learning about webapp security and was thinking it would be nice and encouraging to hear from SO experts what they think of this article (I'm reading it now, it's on session security).
http://carsonified.com/blog/dev/how-to-create-bulletproof-sessions/
Maybe we can have a discussion of some kind, point out what the author misstated/forgot and what better practices are there?
For example when it comes to a different security topic like sql injections, many people recommend things like mysql_real_escape_strings, but the experts will tell you that nothing beats prepared statements. From the comments, this article seems to have its problems, so I'm wondering how far on the good or bad side his content is.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我认为这篇文章非常好，但是这些只是基本概念，如果有人认真尝试制作一个严肃的安全意识应用程序，这样的事情将会得到解决。换句话说，文章的水平相当低。
这里没有解决像中间人攻击这样的问题（尽管我可以想象这样的事情通常超出了应用程序层的范围）。另一个可能的漏洞是随机数生成。因此，根据会话密钥生成的实现，会话密钥的熵可能比最大可能熵低得多，这可能使暴力攻击可行，也可能不可行。
因此，这实际上取决于您的解决方案的安全要求，没有一种安全解决方案适用于所有情况。要应用后者，假设您有一个有效的会话 ID，并且您知道该会话绑定到哪个 IP。还假设本示例中的目标是一家银行。现在我可以执行将资金转入我的帐户的请求，并通过欺骗我的 IP 地址并提供被盗的会话来完成此操作。好吧，我的请求的回复永远不会到达，因为 IP 地址被欺骗了，但谁在乎呢，自从服务器接受了我的请求以来，我就收到了钱。
关键是，根据具体情况，您的安全要求以及您的安全解决方案可能会有很大差异。
I think the article is quite nice, however these are just the basic concepts and if somebody seriously tries to make a serious security aware application, things like this will be addressed. In other words, the level of the article is quite low.
Issues like a man-in-the-middle attack are not addressed here (although i can imagine that something like this is usually outside the scope of the application layer). Another possible vulnerability can be random number generation. So depending on the implementation of session key generation, the entropy of the session keys could be much lower as the maximum possible entropy which may or may not make brute force attacks feasible.
So it really depends on the security requirements you have how the solution will be, there is no single security solution that works in all cases. To apply the latter, imagine that you've got a valid session id and you know to which ip the session is bound. Also assume that the target in this example is a bank. Now i can perform a request to transfer money to my account, and make this work by spoofing my ip-address and providing the stolen session. Ok, the reply of my request will never arrive since the IP address is spoofed, but who cares, I got the money since the server accepted my request.
The point is that depending on the context, your security requirements and thus your security solution(s) may greatly vary.