为了安全起见，将 GET 与 tokenID 结合使用是一个好主意吗？
我正在考虑这个，看来只发布不太容易受到攻击，但有些困难（要求用户单击某些内容）。
我读到了有关令牌 id 和双重提交 cookie 的信息，但我不确定有什么区别
http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Disclosure_of_Token_in_URL http://www.owasp.org/index.php/ Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Double_Submit_Cookies
现在我有用户 ID（我表中的 PK）和会话 ID，因此您不能简单地更改您的 Cookie ID 并像其他人一样行事。现在看来我将会话 ID 作为令牌放入每个表单中并检查它们，因为攻击者无法猜测这些令牌。但是我不喜欢将会话 ID 放入页面中供人们查看的想法。但说实话，这有问题吗？如果用户没有复制/粘贴 html，是否会因为会话 id 在 html 中以普通视图的形式出现而发生任何攻击？
I was thinking about this and it appears POST only a little less vulnerable and somewhat harder (do to requiring the user to click something).
I read about token ids and double submitted cookies and i am not sure what the difference is
http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Disclosure_of_Token_in_URL
http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Double_Submit_Cookies
Right now i have the user id (PK in my table) and a session id so you cant simply change your cookie ID and act like someone else. Now it seems like i put the session id as a token in each of my forms and check them bc attackers cant guess these tokens. However i dislike the idea of putting the session id into the page for ppl to see. But really, is there a problem with that? short of having the user copy/pasting the html is there any attacks that can happen due to the session id being in plain view in html?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果用户可以复制其中包含令牌的链接，这是非常不安全的。对于当前地址也是如此：如果您使用静态会话 ID，则引用外部站点或屏幕截图将使会话受到损害。即使您没有静态会话 ID，用户也可以将鼠标放在链接上，该链接将显示在浏览器底部，然后截取屏幕截图，再次导致其会话受到损害。
If the user can copy a link with a token in it, this is very insecure. Likewise for the current address: if you use a static session ID, a referral to an outside site or a screenshot will render the session compromised. Even if you don't have a static session ID, the user can put his mouse over a link and it will show in the bottom of his browser, and then take a screenshot, once again rendering his session compromised.
无论如何，会话 ID 在客户端是已知的。否则他们会如何将其与请求一起发送？
The session-ID is known on client side anyway. How else would they send it with the requests?