如何实现一个好的系统来登录/退出网络应用程序
我是 PassPad 的开发人员之一，这是一个安全的密码生成器和用户名存储系统。我们仍在努力解决这个问题，但我对实现安全登录/退出系统的最佳方式有一些疑问。
现在，我们计划做的是让登录系统保存一个包含用户名和会话密钥的 cookie，这就是身份验证的全部功能。服务器验证两者是否匹配。登录/退出时会创建一个新密钥。
这是一个与安全相关的网络应用程序，虽然我们实际上并不存储任何可能让用户感到不安的信息，但因为它是面向安全的，所以我们有必要至少显得安全用户会满意的方式。
有没有更好的方法在 PHP 中实现登录/退出系统？最好不会占用太多编码时间或服务器资源。我还需要实施其他什么，例如暴力保护等吗？我该怎么办呢？
I am one of the developers at PassPad, a secure password generator and username storage system. We're still working on it, but I have a few questions on the best way to implement a secure login/out system.
Right now, what we plan on doing is to have the login system save a cookie with the username and a session key, and that's all that serves as authentication. The server verifies the two to match. Upon login/out a new key is created.
This is a security-related webapp and while we don't actually store any information that might make the user queasy, because it is security-oriented it makes it a necessity for us to at least appear secure in a way that the user would be happy with.
Is there a better way to implement a login/out system in PHP? Preferably it won't take too much coding time or server resources. Is there anything else I need to implement, like brute-force protection, etc? How would I go about that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
确保您已阅读2010 年 OWASP 前 10 名，特别是 A3：< a href="http://cwe.mitre.org/data/definitions/724.html" rel="nofollow noreferrer">身份验证和会话管理损坏。这很重要，因为您已经违反了 https 的要求。另请务必阅读有关 CSRF 的信息，强迫人们登录或注销您的服务是一个漏洞。关闭 .htaccess 中的目录列表： http://passpad.org/actions/
我还建议运行Web 应用程序防火墙，特别是如果您是安全 Web 应用程序。 mod_security 是免费的，可以阻止很多攻击。另请确保使用 wapiti（开源）或 acunetix（$$$）测试您的应用程序是否存在漏洞，但请确保在禁用 WAF 的情况下测试您的应用程序。
在强力保护方面，我真的很喜欢 gmail 的方法。在他们获得足够的“热度”之前，不要用验证码提示他们。对系统执行不良操作可能会积聚热量。 Heat 被分配给一个 IP 地址，而不是一个会话。例如，如果他们注册了 2 个用户帐户，您可能需要在第三个帐户时使用 capthca 提示他们。如果您尝试登录失败 3 次，您应该提示他们。如果他们解决了验证码，您可以选择通过降低其热值或将其设置为零来“冷却”他们。使用 reCpathca 是迄今为止最好的。
Make sure you have read the OWASP top 10 for 2010, especally A3: Broken Authentication and session management. This is important because you have already violated its requirements for https. Also make sure to read about CSRF, forcing people to login or logoff from your service is a vulnerability. Turn off directory listing in your .htaccess: http://passpad.org/actions/
I also recommend running a Web Application Firewall, especially if you are a security web app. mod_security is free and will stop a lot of attacks. Also make sure to test your application for vulnerabilities by using wapiti(open source) or acunetix($$$), but make sure you test your app with your WAF disabled.
In terms of brute force protection I really like gmail's approach. Don't prompt them with a captcha until they obtain enough "heat". Heat can be accumulated by performing bad actions against your system. Heat is assigned to an ip address, not a session. For instance if they sign up for 2 user accounts, you might want to prompt them with a capthca for the 3rd. If you have 3 failed login attempts, you should prompt them. If they solve the captcha, you could choose to "cool" them off by lowering their heat value or setting it to zero. Use reCpathca its by far the best.