CodeIgniter 身份验证安全模型
我已经为 CodeIgniter 构建了一个自定义身份验证系统（我知道有各种可用的第三方库，但这是为了我自己的利益），但我担心我错过了一些明显的东西，可能会导致整个事情失败。
我使用 CI 会话（通过数据库）并加密 cookie 值，以进行一些可能毫无意义的混淆。登录通过 SSL 进行（并且 cookie 被修改为仅安全）。我还使用 phpass 来散列密码以进行存储，尽管这与这里并不真正相关。这部分中的某个地方可能存在薄弱环节，但我主要担心的是，页到页检查基本上由 if is_logged_in = true 类型方法及其会话中的用户名组成。这一点让我担心，因为它似乎有点太“容易”了。这种方法很脆弱吗？我是否应该逐页计算用户代理或其他内容的哈希值并确保它们匹配？
任何指示将不胜感激。就像我说的，我知道已有的解决方案，但我试图在这里学习一些知识:)
I've built a custom auth system for CodeIgniter (I know there are various 3rd party libraries available but this is for my own benefit) but I'm worried I'm missing something obvious that could bring the whole thing down.
I use CI sessions (through the database) and encrypt cookie values for a little bit of probably pointless obfuscation. Logins take place over SSL (and cookies are modified to be secure only). I also use phpass to hash passwords for storage, though thats not really relevant here. There may be a weak link in this part somewhere but my main concern is that page-to-page checks basically consist of a if is_logged_in = true type approach along with their username in the session. This bit concerns me as it seems a bit too 'easy'. Is this approach quite vulnerable? Should I be computing a page-by-page hash of, say, user-agent or whatever and making sure they match?
Any pointers would be most appreciated. Like I said, I'm aware of pre-existing solutions but I'm trying to learn me some learning here :)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
你提到的一切都很好。不过我对 phpass 并不熟悉。确保在对密码进行哈希处理时使用的是盐。
if_logged_in = true检查就足够了，因为会话数据存储在服务器端。检查用户代理等内容的原因是为了帮助防止会话劫持，即一个人获取另一个人的会话 ID。Everything you mentioned is good. I'm not familiar with phpass however. Make sure that when you hash the passwords, that you are using a salt.
An
if_logged_in = truecheck is sufficient because session data is stored server-side. The reason for checking things such as user-agent is to help protect against session hijacking, where one person obtains another person's session ID.PS：我不是安全专家，所以我更喜欢使用由安全专家检查的系统：openid、facebook connect、twitter(oauth)、google Signin 等
但这是我的清单（我可以认为off)：
$_SESSION['is_logged_in']$var = filter_var($_SESSION['is_logged_in'], FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);AGAIN 您应该对来自服务器的所有输入执行此操作，因为它们不是安全的。最好的方法是使用白名单而不是黑名单。因为你有可能会错过一些东西。P.S: I am no security expert so I prefer using system that are inspected by security-experts: openid, facebook connect, twitter(oauth), google signin, etc
But here is my Checklist(I can think off):
$_SESSION['is_logged_in']using this filter =>$var = filter_var($_SESSION['is_logged_in'], FILTER_VALIDATE_BOOLEAN, FILTER_NULL_ON_FAILURE);AGAIN You should do that for all input coming from the server, because they aren't safe. The best approach is to use whitelist instead of blacklist. Because there is a chance you will miss something.我不熟悉 phpass 但检查它是否使用 MD5，因为如果使用则它不够好。使用 bycrypt http://www.memonic.com/user/pneff/id/1qHCT
I am not familiar with phpass but check to see if it uses MD5 because if it does then it's not good enough. Use bycrypt http://www.memonic.com/user/pneff/id/1qHCT