会话管理应该如何设计？
我正在寻找有关如何设计安全会话管理系统的一般建议。我目前使用的系统遵循这种设计，但我才意识到这是多么愚蠢就是在每个 URL 中放入所有这些废话，尤其是当您涉及 Web 索引器/Google Analytics 时。我不想认为我完全浪费了时间来遵循写得很糟糕的白皮书，所以我想我的问题是，是否值得重新编写我的会话管理系统，如果是这样，我一般应该如何设计它？谢谢。
I'm looking for general advice on how to design a secure session management system. The system I have in place currently follows this design, but it just dawned on me how stupid it is to put all that crap in every URL, especially when you get web indexers / Google Analytics involved. I'd hate to think that I just completely wasted my time following a terribly-written whitepaper, so I guess my question is, is it worth it to re-write my session management system, and if so, how in general should I design it? Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这两篇文章应该会给您更多见解 -
* http://www.linuxforu.com /2011/02/secure-apache-part-6-attacks-session-management/
* https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Session_Management
These two articles should give you more insights -
* http://www.linuxforu.com/2011/02/securing-apache-part-6-attacks-session-management/
* https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Session_Management