php Sessions，选项卡式浏览解决方案？
所以，我大约 6 年前写了一些软件，即将发布 2.0 版本。最近，人们一直抱怨一个客户的数据已被转移到另一个客户。罪魁祸首-使用打开多个选项卡，但浏览器共享单个会话。 （我得到了一个“哦，顺便说一句，这种情况已经发生了一段时间了......”）
幸运的是，我在发布 2.0 之前就已经意识到了。我的解决方案是在登录时创建一个随机的 session_name 。然后，该名称会不断发布或获取到应用程序中的其他页面。效果很好。缺点是，有人可以查看源代码并看到类似 更不用说生成的报告（使用 GET）将在 URL 中显示“&session=LSDT2341335054”。
这是一个非常快速的修复，效果很好，但我找不到更好的东西。我自己工作，所以没有任何魔鬼代言人。除了有点草率之外，这种方法还有什么真正的风险吗？仅仅因为我看不到这方面的问题，并不意味着它们不存在。
谢谢，戴夫
So, I wrote some software about 6 years ago, and am about to release version 2.0. Recently, people have been complaining that data from one customer has been transferred to another. The culprit- uses having multiple tabs open, but browsers sharing a single session. (I got an "oh, by the way, this has been happening for a while now... ")
Luckily, I was made aware before I launch 2.0. My solution is to create a random session_name at log-in time. Then this name is constantly posted or geted to other pages in the application. It works great. The drawback, is that someone can look at the source code and see something like <input type="hidden" name="session" value="LSDT2341335054" /> Not to mention that a generated report (using GET) will show "&session=LSDT2341335054" in the url.
This was a very quick fix and it works great, but I could not find anything better out there. I work by myself so don't have any type of devil's advocate. Other than being a little sloppy, are they any real risks to this method? Just because I can't see a problem with this, doesn't mean they don't exist.
Thanks, Dave
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
那么，这个新系统难道不是在之前的会话系统之上增加了一层，用户只能看到自己的会话标识符吗？
无法真正看到问题，它在这里似乎非常安全，让我想起 Facebook 消息传递等中使用的东西。
正如 deceze 所说，您可以使用 cookie 并检查值匹配，或类似的方法。
Well, isn't this new system just an extra layer on top of the previous session system, and users will only be able to see their own session identifier?
Can't really see the issue, it seems perfectly safe here, reminds me of things used in facebook messaging etc.
As deceze said, you could use cookies and check the values match, or a similar method.