窃取会话 ID cookie - 对策
通过其他用户在受信任站点中植入的 JavaScript 函数，可以轻松窃取会话 ID Cookie。针对这种攻击有哪些可能的对策？
拒绝客户端上的所有 javascript 脚本可能很困难，因为几乎所有网站都使用 js。服务器端有哪些可能的对策？是否可以在会话 ID 值中包含客户端 IP 地址的哈希值，以防止其他主机使用有效的会话 ID？这种方法有意义吗？
在您有价值的答案中提到的资源之一中，提出了一种解决方案，其中会话 ID 在每次请求后都会更改。应用程序服务器/框架是否已经支持这样的功能？特别是 Django/python 怎么样？
It is easy to steal session id cookies with javascript functions planted in trusted sites by other users. What are the possible counter-measures for this kind of attack?
Rejecting all javascript scripts on the client-side is probably difficult because almost all sites use js. What are the possible counter-measures on the server-side? Is it possible to include a hash of the client ip-address in the session id value to prevent that a valid session id be used from another host? Does this approach make sense?
In one of the resources mentioned in your valuable answers a solution is proposed where the session id is changed after every request. Is such a feature already supported by the app servers / frameworks? In particular how about Django/python?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
进行 IP 到会话映射确实很尴尬，因为您无法保证人们不使用代理，而且这些代理可以轻松更改 IP。
您能做的最好的事情就是使用 SSL，并使您的 cookie 仅限 HTTP。
It's really awkward to do IP to session mapping, because you don't have guarantees that people aren't using proxies, and those proxies could easily change IPs.
The best thing you can do is use SSL, and make your cookies HTTP-only.
您需要指定某个 cookie 用于某个主机、域、子域或其他任何内容。 Cookie 支持这一点。
我不认为您可以访问其他域的 cookie。
You'd want to specify that some cookie is for some host, domain, subdomain or whatever. Cookies support that.
I don't think that you can access cookies from other domains.
在某些情况下，这可以阻止会话劫持，但在攻击者计算机和受害者计算机位于同一网络的情况下，它不会执行任何操作，因为连接来自同一 IP 地址。
如果某人连接到公共网络，使用 SSL 将有助于防止会话劫持。
您可以检查您的代码并确保没有 XSS 缺陷在你的代码中。
您还可以确保用于存储会话的 cookie 具有 HTTP Only 标志。
This can block session hijacking in some situation, but in situation where the attacker computer and victim computer are on the same network, it won't do anything since the connection comes from the same IP address.
Using SSL will help prevent session hijacking if a person is connected to a public network.
You can review your code and make sure you have no XSS flaw in your code.
You can also make sure the cookie used to stored the session has the HTTP Only flag.
这称为 XSS。首先防止在客户端植入 JavaScript 代码的最佳解决方案。
一个有趣的解决方案是为每个用户操作提供基于令牌的身份验证。请查看 OWASP CSRF 页面了解更多信息。编辑： 正如评论所述，令牌无助于缓解会话劫持问题。正如维基百科文章关于会话劫持所述，最好的解决方案是轮换会话 ID，每次重新加载页面时都可以这样做。
This is called XSS. The best solution in to prevent the planting of JavaScript code on the clients in the first place.
An interesting solution is to provide a token-based autentication to every user operation. Check out the OWASP CSRF page for more information.Edit: As the comment says, the token won't help mitigating the session hijacking issue. As the Wikipedia article says about Session Hijacking, the best solution is to rotate the Session ID, possible every time the page reloads.
使用以下简单的 javascript 片段过滤您的 javascript（从输入）：
函数清理(html){
`返回字符串(html)
.replace(/&(?!\w+;)/g, '&')
。代替（/
.replace(/>/g, '>')
.replace(/"/g, '"');
}
必须还具有良好的服务器端过滤（输入）功能。例如，PHP 有过滤器扩展。
filter your javascript(from input) using for example this simple javascript snippet:
function sanitize(html){
`return String(html)
.replace(/&(?!\w+;)/g, '&')
.replace(/
.replace(/>/g, '>')
.replace(/"/g, '"');
}
You MUST also have good filtering(input) server-side. For example PHP has filter extension.