php 会话劫持 - HTTPS 足够吗？指纹识别有什么建议吗？
我使用 HTTPS，但希望最大限度地降低有人使用其他人最近实际使用的会话 ID 恶意制作自己的 cookie 的风险。
作为会话变量，我有一个到期时间，因此如果最近未使用会话，会话就会失效，因此我认为机会之窗是当受害者处于活动状态或最近离开网站而未正确注销时。
我预计不会有大量的流量，并且我使用标准 php 方法来生成会话 ID。我相信有人真正成功（甚至尝试）劫持某人的会话的“风险”接近于零。
我想做的是以某种方式“识别”远程用户，不使用$_SERVER['REMOTE_ADDR']。我的想法是，攻击者必须找到有效的会话 ID，以及 模仿实际用户的不同属性。
我不想强迫用户使用证书登录。我希望它可以在所有标准网络浏览器中工作，即使对于我的祖母和其他像她这样的非技术人员也是如此。
那么，我本来想问的是：HTTPS会话有什么“属性”可以使用吗？它们有用吗？如果是这样，我该如何找到它们？ phpinfo() 没有透露任何 HTTPS 特定内容。 （是因为 httpd 没有公开它吗？）
我应该只使用 HTTP_USER_AGENT + HTTP_ACCEPT + HTTP_ACCEPT_LANGUAGE 的串联code> + HTTP_ACCEPT_ENCODING + HTTP_ACCEPT_CHARSET 或者类似的东西被认为在用户之间足够唯一？
对所有答案感到非常高兴！ （但请在回答前先阅读问题，仅参考 StackOverflow 上的其他问题） 谢谢你！
I use HTTPS, but want to minimize the risk of someone evil crafting their own cookies with a session ID that someone else actually uses recently.
As a session variable I have an expiry time so the session is invalidated if it hasn't been used recently, so I figure the window of opportunity is when the victim is active or recently left the site without logging out properly.
I don't expect huge amounts of traffic and I use the standard php methods of generating session IDs. I believe the "risk" of someone actually succeed (or even try) hijacking someones session here is close to zero.
What I would want to do is to "identify" the remote user somehow, without using $_SERVER['REMOTE_ADDR']. My thoughts being that the attacker would have to both find a valid session ID, as well as impersonating the different properties of the actual user.
I don't want to force the user to use a certificate to log in. I want it to work in all standard web browsers, even for my grandmother and other non tech-people like her.
So, what I originally wanted to ask was: are there any "properties" of the HTTPS session that could be used? Would they be useful? If so, how do I find them? phpinfo() reveals nothing HTTPS specific. (Is it because httpd doesn't expose it?)
Should I just use a concatenation of HTTP_USER_AGENT + HTTP_ACCEPT + HTTP_ACCEPT_LANGUAGE + HTTP_ACCEPT_ENCODING + HTTP_ACCEPT_CHARSET or something similar that is assumed to be unique enough between users?
Very happy for all answers! (But please read the question before answering with only referrals to other questions on StackOverflow)
Thank you!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您需要确保在会话 cookie 上设置了 secure 和 http_only 标志。您还需要在用户进行身份验证时更改 session_id 以避免会话固定问题。
虽然您提出的建议在指纹识别方面应该相对安全，但实际上并不是那么有选择性 - 还有很多东西不应该用于指纹识别（例如 CLIENT_ADDRESS），因此要提出更好的建议并不容易。
除了上面的建议之外，我建议您花时间研究其他潜在的安全问题。
C.
You need to ensure that you've got both the secure and http_only flags set on your session cookies. You also need to change the session_id when a user authenticates to avoid session fixation problems.
While what you propose should be relatively safe in terms of finger-printing, it's not really all that selective - otoh there are lots things which should NOT be used for fingerprinting (like CLIENT_ADDRESS) so its not really very easy to suggest something better.
Apart from my suggestions above, I'd recommend spending your time looking at other potential security problems.
C.
OWASP Top 10 是针对此类攻击的绝佳辅助工具。
具体来说，您需要担心这三个：
A2：Cross-站点脚本 (XSS)
A3：损坏的身份验证和会话管理。
< a href="http://www.owasp.org/index.php/Top_10_2010-A5-Cross-Site_Request_Forgery_(CSRF)" rel="nofollow noreferrer">A5：跨站请求伪造 (CSRF) （也称为“会话骑乘”）
几乎所有 $_SESSION 变量都是攻击者已知的，并且可以是任何值。检查这些变量是没有意义的，因为攻击者影响它们是微不足道的。一个重要的例外是
$_SERVER['remote_addr']它是直接从 apache 的 TCP 套接字拉取的，因此该值不能被欺骗或以其他方式篡改。但是，如果攻击者位于同一网段（例如，如果他在咖啡馆里在你身后喝咖啡），则攻击者将拥有相同的 IP 地址。The OWASP top 10 is an excellent aid for this class of attacks.
Specificlly you need to worry about these three:
A2: Cross-Site Scripting (XSS)
A3: Broken Authentication and Session Management.
A5: Cross-Site Request Forgery (CSRF) (Also known as "Session Riding")
Almost all of the $_SESSION variables are known to the attacker and can be any value. There is no point is checking these variables as it is trivial for an attacker influence them. A important exception is
$_SERVER['remote_addr']which is pulled directly from apache's TCP socket, thus this value cannot be spoofed or otherwise tampered with. However, if the attacker is on the same network segment (such as if he was sipping a cup of coffee right behind you at the cafe), then the attacker would have the same ip address.