关于保护 SWFUpload 的思考
使用由 Javascript 控制的 Flash 上传器（例如 SWFUpload）的问题之一是 Flash 在执行上传脚本时启动自己的会话。这意味着如果上传脚本对用户进行身份验证，它将失败。
解决此问题的一种方法是将 PHPSESSID 作为 post 参数传递给脚本。然而，这并不是一个完美的解决方案，因为许多托管提供商都打开了 PHP 设置“session_use_only_cookies”，从而阻止从请求中接受会话 ID。
显然，有时您不希望匿名用户执行您的上传脚本，并从天知道的地方传递天知道的内容，这显然是一个主要问题。
我想知道除了会话和 cookie 之外是否有人有任何其他想法来验证用户身份。是否可以验证 Flash 请求是否来自预期来源以及有效用户是否发起了该请求。使用除 PHPSESSID 之外的某种令牌，也许，这如何工作（如果有的话）？
One of the issues with using a Flash uploader controlled by Javascript (e.g. SWFUpload) is that Flash starts its own session when executing the upload script. This means that if the upload script authenticates the user, it will fail.
One way around this is to pass a PHPSESSID as a post parameter to the script. This isn't a perfect solution, however, since many hosting providers have the PHP setting "session_use_only_cookies" turned on, preventing session IDs from being accepted from the request.
It's obviously a major concern at times that you don't want anonymous users executing your upload script, passing it god-knows-what from god-knows-where.
I'm wondering if anyone has any alternative ideas for authenticating users other than sessions and cookies. Would it be possible to validate that the Flash request came from the expected source and that a valid user initiated the request. Using some kind of token other than PHPSESSID, perhaps, how could this work, if at all?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
不可靠，不。您永远无法可靠地验证 Flash 请求是否来自“预期来源”。您只能验证其内容。
您可以发明自己的“会话恢复令牌”（又名“记住我 cookie”）功能来将 SWFUpload 会话与 PHP 会话关联起来。但它不会验证客户端软件，只会验证两个会话之间的关系。
Not reliably, no. You can never reliably validate that the Flash request came from "the expected source". You can only validate its contents.
You could invent your own "session resumption token" (a.k.a. "remember me cookie") functionality to associate an SWFUpload session with a PHP session. But it wouldn't authenticate the client software, just the relationship between the two sessions.