通过纯 CGI 进行会话管理
我目前正在使用 C 中的 CGI 作为一个业余爱好项目编写一个小博客/通用发布系统，现在需要一个会话管理系统来验证授权用户的身份，以便在 上进行发布、编辑和类似操作多个 CGI 程序
在几年前使用 PHP 时，我记得使用了超全局变量 $_SESSION 和一些会话初始化函数。 显然在处理纯 CGI 时，这种方式是行不通的，所以我的处境很棘手。
一点思考表明，有很多不同的方法可以做到这一点...
- 将 IP 地址和属性保存在一个文件中，我可以在其中查看特定 IP 是否已授权
- 与 #1 相同，但使用 SQLite 数据库（我的引擎已经运行在 SQLite 上，所以不会有额外的开销）
- 也许有 cookies 的东西？
与其全力以赴，然后后悔……你们好人怎么想？什么是最有效（也是最重要）且可维护的方法？
请注意，我不想想让第三方库为我做所有复杂的事情！我开始这个项目是为了完全自己构建一些东西（如果你在这里忽略 SQLite），我不想隐藏困难的部分，即使它使一切变得更加简单。如果我不想折磨自己的话，我可以直接使用 Python :)
I'm currently in the process of writing a little blog / generic posting system using CGI in C as a hobby project and am now in the need of a session management system to authentificate authorized users for posting, editing and similar operations over multiple CGI programs
From working with PHP years ago I remember using the superglobal variable $_SESSION and some session intializing functions. Obviously this is not going to work this way when dealing with pure CGI, so I'm in a tricky situation here.
A bit of thinking showed that there's many different ways to do such a thing...
- Saving the IP address and attributes inside a file where I can see if a particular IP is authorized
- Same as #1 but using an SQLite database (my engine already runs on SQLite so there would be no additional overhead)
- Something with cookies maybe?
Instead of going all in and regret is later... what do you good people think? What's the most efficient (and most importantly) and the maintainable method?
Please note that I do not want to get a third party libary to do all the complicated things for me! I started this project to build something completely by myself (if you ignore SQLite here) and I don't want to hide the hard parts, even if it makes everything so much simpler. I could have just used Python if I didn't want to torture myself :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
基于 Cookie 的会话管理是可行的方法。您不能仅仅使用 IP 地址，甚至不能使用 IP 地址 + 浏览器组合，因为当人们使用代理或位于 NAT 之后时，这会失败。
只需向浏览器发送 cookie 中的哈希值，然后根据您的用户记录验证该哈希值，如果匹配，您就可以访问该用户会话的数据。
考虑为哈希添加过期机制。在安全性和易用性之间需要权衡，因为相同的哈希对用户有效的时间越长，用户容易受到 cookie 窃取攻击的时间就越长。
过期机制还将使您能够从数据库（或文件，如果您愿意的话）中删除过时的会话数据。
Cookie based session management is the way to go. You cannot merely use an IP address not even IP address + browser combination because that will fail when people are using proxy or are behind NAT.
Just send the browser a hash in a cookie, then validate the hash against your record for the user, if it matches, you can then access the data for that user's session.
Consider adding an expiry mechanism for the hash. There is a trade off between security and ease of use, because the longer the same hash is valid for the user, the longer the user is vulnerable to a cookie stealing attack.
Expiry mechanisms will also enable you to delete stale session data from your database (or file, if you would so choose.)