如何通过cookie安全地记住用户？
假设我有一个会员基础网站，当用户登录时，我放置一个带有键值对的 cookie（或会话）来记住用户是谁。但我刚刚注意到我应该使用哪些信息来记住用户以确保其安全。我不能使用 username=username 或 user_id = user_id （因为我的 user_id 将为 1），因为人们可以简单地猜测 cookie 值是什么并以该用户身份登录。那么我应该使用什么键/值对来识别用户并仍然安全地将他们的信息连接到数据库？谢谢。
So lets say i have a member base website and when the user signs in i put put a cookie (or a session) with a key value pair remembering who the user is. But its just come to my attention which information i should use to remember the user so that its secure. I cant use username=username or user_id = user_id (because my user_id will be 1), because people then can just simply guess what the cookie values are and logged in as that user. So what key/value pair should i use to be able to identify users and still connect their information to the database securely? Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
Ben，您需要关注几种不同类型的攻击。例如，简单地使用私钥加密标识符并不能阻止能够拦截加密值的人将其简单地重播到您的服务器（并且看起来是用户）。此处详细介绍了一些常见的安全风险（以及本页底部的相关链接）：
https:// www.owasp.org/index.php/Session_hijacking_attack
会话管理可能非常复杂，并且根据您需要的安全级别，这不是您想要自己解决的问题，因为您的开发环境/框架可能已经有一个解决方案有比自制解决方案经过更多审查。这里有一个链接，详细说明了一些需要考虑的事项，不幸的是，这个主题不仅仅是一个简单的 Stack Overflow 帖子：
https://www.owasp.org/index.php/Session_Management
Ben, there are a few different types of attacks you need to be concerned with. For example simply encrypting the identifier with a private key doesn't prevent someone who can intercept the encrypted value from simply replaying it to your server (and appear to be the user). Some common security risks are detailed here (and in associated links at bottom of this page):
https://www.owasp.org/index.php/Session_hijacking_attack
Session management can be quite complex and depending on the level of security you require, it is not something you want to tackle yourself, because likely your development environment / framework already has a solution that has been vetted moreso than a homebrew solution. Here is a link detailing some things to consider, unfortunately this topic has more to it than a simple Stack Overflow post:
https://www.owasp.org/index.php/Session_Management
如果您出于某种原因不喜欢加密，那么更简单的解决方案可能是使用 GUID 来识别用户。这样，黑客就必须对您的应用程序发起拒绝服务类型的攻击，才能运行 GUID 的一小部分。
如果您想正确执行此操作，那么您还应该看看 http://jaspan.com/improved_persistent_login_cookie_best_practice 。
If you dont prefer encryption for whatever reason, then a simpler solution could be to use a GUID to identify the user. This way, a hacker would have to launch a denial of service kind-of attack on your application to be able to run through even a very small fraction of the GUIDs.
If you want to do this properly, then you should have a look at http://jaspan.com/improved_persistent_login_cookie_best_practice also.
我绝对不是安全方面的专家，但我最近实现了用户管理工具，并且做了以下工作。
以下是您需要在服务器上存储的内容 - 为了验证每个请求。
我在 cookie 中存储的内容遵循
如何使用此基本安全性
只需在用户登录时检查用户名/密码等（只是通常）如果一切正常，则登录用户并生成新的cookiehash 并填写上面给出的值。
每个请求都会根据其哈希值检查 UserId。如果有人提供 UserId = 4 但哈希不匹配，则会自动删除会话并将用户转发到登录屏幕。可能的日志可以很好地了解人们尝试玩弄你的辛勤工作的频率。
我希望这有帮助。
I'm definitely not an expert in security, but I have recently implemented user management tool and I have done the following.
Here is what you do need to store on the server - in order to authenticate each request.
What I store in cookie is following
How to use this basic security
Simply when user logs in you check username/password etc. (just the usual) If everything is fine then log in user and generate new cookiehash and fill those values given above.
Every request check UserId against its hash. If someone gave UserId = 4 but hash didnt match then automatically drop a session and forward user to login screen. Possible log is good to see how often people try to play around with your hard work.
I hope this helps.
您可以使用保存在服务器上的私有加密密钥来加密用户 ID。使用这种方法需要注意以下几点：
虽然我不认为这些是主要障碍，但它们可能对您来说是，并且您必须自己评估对您网站的影响。
You can just encrypt the user id with a private encryption key that you keep on the server. There are a few things to watch out for with this approach:
While I don't think that these are major hurdles, they might be to you, and you would have to evaluate the impact on your site for yourself.