如何限制只有一台机器才能访问Web应用程序？
我需要确保访问我的 Web 应用程序的每个用户都只能从一台计算机上执行此操作，因此 100 个用户意味着 100 台计算机。最好的解决方案是什么？在首次登录时检测并存储 IP 是个好主意吗？我认为即使在会话的生命周期内 IP 也可能会发生变化，对吗？我还考虑在用户首次登录时存储 cookie。然后将这些 cookie 分配给用户，就像我对密码和用户名所做的那样，并且每次访问应用程序时都会检查该 cookie 是否存在。
请告诉我您认为最好的解决方案是什么。如果重要的话，我的后端是 php/mysql 。
编辑：我需要澄清...这是正常会话管理之外的。我需要限制用户只能从一台特定的计算机登录 Web 应用程序。因此，如果用户最初在工作时从他的计算机登录并且我存储了其 ip/cookie/等，那么客户端注销（甚至不注销）、回家并尝试登录将无法做到这一点。我同意这个可怕的想法，但客户坚持:)
I need to make sure that every users accessing my web application can do that from one machine only, so 100 users would mean 100 machines. What would be the best solution? Is detecting and storing IP during first login good idea? I think IP might change even during lifetime of the session is that right? I was also thinking of storing cookie when user first logs in. Then assigning these cookie to the user, same as I do with password and username already, and every time when accessing application checking for presence of that cookie.
Please let me know what in your opinion would be the best solution. My backend is php/mysql if that matters.
EDIT: I need to clarify... This is in addition to normal session management. I need to restrict users to be able to login to web application from one specific machine only. So if user originally logged in from his computer at work and I stored its ip/cookie/etc., then client logs out (or even not), goes home and tries to login won't be able to do that. I agree its horrible idea but client insists :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
对于移动客户端或在有线和无线网络之间切换的客户端，IP 地址可能会发生变化。最好的选择可能是在每个客户端首次连接时为其提供一个随机生成的 UID（如果它还没有 cookie）。然后您可以检查同一用户名是否未使用两个不同的 UID 进行连接。
诀窍在于，您需要确保此 UID 超时，这样，如果用户转到另一台计算机，他们就不会被锁定。也许对 UID 进行一次更改是可以的，但是他们不能返回到已经使用过的 UID？
IP address might change in the case of mobile clients, or clients that switch between wired and wireless networks. Your best bet would probably be to provide a randomly-generated UID to each client when it first connects (if it doesn't already have the cookie). Then you can check that the same username isn't connecting using two different UIDs.
The trick is that you need to make sure to time this UID out, so that if the user goes to another computer they aren't locked out. Perhaps one change to the UID is okay, but they can't go back to a UID that's already been used?
您可以通过向客户端颁发使用 keygen 元素创建的客户端 SSL 证书来限制单个用户代理，这会让浏览器生成密钥对，将私钥保留在用户代理中，然后您会收到一个 SPKAC，您可以使用该证书可以使用 openssl 创建一个证书，然后将其发送回用户代理，用户代理会安装该证书，并且从那时起它只能通过 HTTP+TLS 来识别该特定浏览器中的用户。
任何其他方法都无法 100% 工作 - 尽管您可以破解看似有效的方法（直到出现问题并且不起作用）:)
You can limit to a single useragent by issuing the client with a client side SSL certificate created with the keygen element, this gets the browser to generate a key pair, keeping the private key in the user agent, then you receive an SPKAC, which you can use to openssl create a certificate, which you then send back to the user agent, it installs it and it can be used to identify the user in that specific browser only via HTTP+TLS from then on.
Anything else, simply won't work 100% - although you can hack ways that appear to work (until something goes wrong and it doesn't work) :)
不幸的是，由于多种原因，IP 不是特定于计算机的：
机器 相反，为会话生成某种唯一密钥并结合用户名进行跟踪。如果相同的用户名已存在于另一个活动会话中，则阻止他们登录。 （您还需要某种方法来自动刷新这些，以防万一您丢失会话结束事件。）
Unfortunately, an IP is not machine-specific for multiple reasons:
Instead, generate some kind of unique key for the session and track it in combination with the user name. Prevent them from logging in if the same user name is already in another active session. (You'll also want some way to automatically flush these, just in case you lose the session-end event.)
最佳解决方案已内置于 Web 服务器中，具体取决于您使用的解决方案。这就是会话的用途。在 ASP.NET/IIS 中，通常每个会话有 20 分钟的超时时间。
因此，如果用户使用另一台计算机访问您的 Web 应用程序，则会话超时将释放空闲计算机的连接。
更新
您可能需要考虑通过其计算机的唯一 MAC 地址来限制用户。
The best solution is already built into the web server depending on which one you are using. That's what the Sessions are for. In ASP.NET/IIS, usually there is a 20minutes per session timeout.
So if a user uses another computer to access your webapplication, then the session timeout will release connection from the machine that is idle.
UPDATE
You might want to consider restricting user by the MAC Address of their machines which are unique.
如果它是一个非常内部的应用程序，仅在公司内部使用，则可以定义一个 IP 范围，因为不在全球范围内运营的较小公司可能会从其互联网接入提供商那里获得一定数量的 IP。
您还可以考虑使用 $_SERVER 中的一些信息来将用户限制为单个 Web 浏览器 (HTTP_USER_AGENT) 和单个端口 (REMOTE_PORT) 的组合 - 作为区分计算机的附加方法。
但所有这些解决方案都很糟糕或更糟，从技术上讲可能无法解决这个问题（除非您的客户保证所有计算机都将保留静态IP，在这种情况下，如果有其他问题，这是一个微不足道的问题）。
If it is a very internal application that will be used only inside a company, it might be possible to define an IP range because smaller companies which do not operate worldwide will probably have a certain amount of IPs from their internet access provider.
You could also think about using some info from $_SERVER to restrict users to a combnation of a single web browser (HTTP_USER_AGENT) and a single port (REMOTE_PORT) - as an additional way to differentiate machines.
But all these solutions are bad or worse, it's technically probably not possible to solve this problem (unless you will have guarantees from your client that all machines will keep a static IP in which case it is a trivial if else problem).
不要那样做。许多人会从多台计算机访问您的网站，如果您阻止他们，他们会抱怨。
Don't do that. Many people will access your website from multiple computers, and they will complain if you block them.