如何加密cookie中的会话id？
当我阅读有关会话劫持的文章时，我了解到对存储在 cookie 中的会话 ID 值进行加密会很好。
据我所知，当我通过调用 session_start() 启动会话时，PHP 不会加密 cookie 中的会话 id 值。
如何加密会话 ID 值，然后用它初始化会话？
While I was reading about session hijacking articles, i learned that it would be nice to encrypt session id value that is stored in a cookie.
As far as I know, when I start a session by calling session_start(), PHP does not encrypt session id value in a cookie.
How do I encrypt session id value and then initialize session with it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
加密没有帮助。无论如何，会话 cookie 只是一个神奇的数字。加密它只是意味着有一个不同的魔术数字可以劫持。根据您想到的劫持场景，还有其他可能的缓解措施。例如，您可以将会话限制为单个 IP。但这会带来一些问题，例如人们在无线点之间切换。
Encrypting won't help. The session cookie is just a magic number anyway. Encrypting it just means there's a different magic number to hijack. Depending on what hijacking scenarios you have in mind, there are other possible mitigations. For example, you can limit sessions to a single IP. That poses some issues though, e.g. people switching between wireless points.
更重要的是，您的会话 ID 是随机的（也就是说，某人无法使用自己的会话 ID 来猜测另一个人的会话 ID），因为真正的危险是有人获取其他用户的会话 ID。只要你让它们真正随机，就没有理由或实用性对其进行加密
It's more important that your session IDs are random (that is, someone can't use their session ID to guess another person's), as the real danger is somebody getting their hands on another user's session ID. As long as you keep them truly random, there's no reason to or utility in encrypting it
假设您的会话 cookie 是 GUID，则对其进行加密是没有意义的。它只会将一个伪随机字符串替换为另一个伪随机字符串。
Assuming your session cookie is a GUID, there is no point encrypting it. It would just replace one pseudo-random string with another.
制作此脚本，从网络浏览器访问它，然后检查您的 cookie。
如果生成一个漂亮的、唯一的 id，您可能会看到类似这样的
PHP 做得很好。加密这个没有意义。
Make this script, access it from a web browser, then check your cookies.
You will likely see something like this
PHP does a fine job if generating a nice, unique id. There's not point in encrypting this.
不幸的是，加密会话 ID 不会大幅提高安全性，因为攻击者只能使用加密形式（无论如何，这是他们唯一可见的东西）。
唯一可能阻止的是您向某人发送包含 ?PHPSESSID=foo 的链接的技巧，这将导致 PHP 创建该会话。您可以通过使用加密和验证来防止这种情况，但您应该完全关闭 URL 中的会话 ID 传输。
Unfortunately encrypting the session ID is not going to increase security much, as the attacker can just use the encrypted form (which is the only thing visible to them anyways).
The only thing this might prevent is the trick where you send someone a link with ?PHPSESSID=foo in it, which will cause PHP to create that session. You can prevent that by using encryption and validation, but you should rather turn off session ID transfer in the URL completely.
会话 ID 相对难以猜测，因此这并不是真正的问题。
您可以采取一些与此相关的措施来抵御攻击：
还有很多其他事情。我总是建议学习关于这些问题的 Rails 指南 - 它提供了对已知问题和对策的非常容易理解的解释——所有这些都同样适用于 PHP 代码。
The session ID is relatively unguessable, so that's not really the issue.
There are a things you can do related to this to counteract attacks:
There are quite a few other things as well. I always recommend studying the Rails Guide on these issues-- it offers a very accessible explanation of known problems and countermeasures-- all equally applicable to PHP code.
永远不要仅仅依赖一个 cookie 或项目来验证您的（登录）用户，这始终是一个好主意。如上所述，最好也存储 IP 并进行检查。一个好的补充是存储 USER_AGENT。
请记住，如果您的应用程序是开源的，那么您只需使用会话 ID 就可以了，因为黑客可以轻松识别您正在验证的内容。
It's always a good idea to never depend on solely on one cookie or item to validate your (logged in) user(s). As mentioned above, it's a good idea to also store the IP and check with that. A good addition would be to store the USER_AGENT.
Bare in mind that if your application is open sourced, you're just as good with a session id alone because the hacker could easily identify what it is you're validating against.
当您使用 cookie 存储敏感信息时，对 cookie 数据进行加密是有意义的。只有服务器应该读取（解密）。
没有理由加密会话 ID，因为黑客可以使用加密的会话 ID 来冒充受害者。
It makes sense to encrypt cookie data when you use cookies to store sensitive info. that only the server should read (decrypt).
There's no reason to encrypt session id, since the hacker can use that encrypted session id to impersonate his victim.