php5 中的无 cookie 身份验证
在我的 PHP 应用程序中，我使用了 UserName & pwd并检查数据库中的用户表，检查用户的有效性。登录成功后，我将凭据存储在服务器会话中，如下所示：
$_SESSION['username'] = $username;
$_SESSION['pwd'] = $pwd;
我检查了会话以确保用户已经登录。您可以看到下面的代码：
if (empty($_SESSION['userId']))
header("Location: login.php");
问题是如果我在浏览器中禁用了 cookie ，即使登录成功也无法进入其他页面。我发现，PHP 会话使用 cookie 在浏览器中存储一些值。无论如何，在 PHP5 中可以使用 cookieless 会话吗？
In my PHP application, I used UserName & Pwd and check the user table in the database to check the validity of users. After the login is successful, I stored the credentials in the Server Session as below:
$_SESSION['username'] = $username;
$_SESSION['pwd'] = $pwd;
And I checked the session to ensure that the user has already logged in. You can see the code below:
if (empty($_SESSION['userId']))
header("Location: login.php");
The problem is if I disabled the cookie in the browser, I could not go into another page even though the log in is successful. I found out that, the PHP session uses the cookie to store some values in the browser. Is there anyway to use cookieless session in PHP5?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
是的，但您需要将
sessid或sid附加到每个链接。这里有详细描述：
http://myles.eftos .id.au/blog/2005/11/26/cookie-less-sessions-in-php/
您还需要更改
php.ini，如下所示：php_value session .use_trans_sid = 1。Yes, but you need to append the
sessidorsidto every link.It's described in detail here:
http://myles.eftos.id.au/blog/2005/11/26/cookie-less-sessions-in-php/
You also need to change
php.inilike so:php_value session.use_trans_sid = 1.是的，但你不想。事实上，您应该仅使用基于 cookie 的会话。这是 PHP 5.3 的默认配置。请阅读会话固定了解更多信息。
您在什么情况下迫使您要求用户能够在没有 cookie 的情况下使用您的网站？
Yes, but you don't want to. In fact, you should only use cookie-based sessions. This is the default configuration as of PHP 5.3. Please read up on session fixation for more information.
What circumstances do you have that force you to require users be able to use your site without cookies?
是的，您可以通过启用
session.use_trans_sid来实现。然而，这样做存在安全问题。人们普遍认为，为了登录，需要接受 cookie。
另一种选择是使用 http 授权而不是会话，尽管这也有其缺点。
请参阅会话 ID 传递。
Yes, you can, by enabling
session.use_trans_sid. However, there's security concerns with doing so.It's generally accepted that in order to login, one needs to accept a cookie.
The other alternative is to use http authorisation instead of sessions, though this also has it's drawbacks.
See session id passing.
您可以生成一个会话 ID，并将其添加到您的链接中，如下所示
You could generate a session id, and add it to your links like this