如何在 cookie 中安全地存储数据
我有一个关于 cookie 存储设计的问题。我正在开发一个 Web 应用程序，该应用程序应该将服务器获取的数据缓存到本地存储。不会存储任何用户凭据。
cookie 中包含的内容：
- 数据列表及其属性的
- 最新性证明
最新性证明不会是哈希值，而很可能是最后一次写入服务器的时间戳（根据数据库进行检查） 。这是为了确保用户在其他浏览器/计算机/设备上使用该网站并且不同步时获得有效信息。
cookie 应该能够处理其中的多个用户，并且很可能进行某种加密，以便其他人无法看到纯文本数据。这里不需要军事级安全，因为这里的信息并不那么重要。但在 30-60 分钟内被黑客入侵的所有内容都应该被认为是不安全的。
问题：
- 如何加密我的数据
- 如何为多个用户启用 cookie
- 如何防止 cookie 被盗
- 呈现禁用 cookie 缓存的选项并向我的用户解释使用缓存的风险的好且简单的方法是什么公共计算机
- 整个想法有什么好处吗？
- 还有哪些我没有考虑到的潜在问题
I have a question concerning cookie storage design. I am developing a web application which should cache it's server-fetched data to a local storage. No user credentials will be stored.
What is in the cookie:
- list of data and it's properties
- proof for up-to-dateness
Proof for up-to-dateness will not be a hash, but most likely a timestamp of the last write to the server which is checked against the DB. This is to ensure the user gets valid info if he has used the website on another browser/computer/device and is out of sync.
The cookie should be able to handle more than one user in it and most probably some sort of encryption so other people can't see plain-text data. Military-grade security isn't needed here as the information here is not so important. But everything hacked in less than 30-60 minutes should be considered unsafe.
Questions:
- How to encrypt my data
- How to enable the cookie for multiple users
- How to prevent the cookie from being stolen
- What would be a good and simple way to present the option to disable cookie caching and explain to my users the risks of using caching on public computers
- Is the whole idea any good at all
- What are some potential issues I haven't accounted for
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我将回答#5（这使得其余问题毫无意义）。
Cookie 不是为此类事情而设计的。它们与每个 HTTP 请求进行往返 - 包括同一域的 CSS、图像、JS 等。
我建议您查看 HTML 5 本地存储，或者每次都将数据发送到浏览器带有最小的密钥 cookie。
对于#3 - 没有一种方法可以万无一失地防止某人窃取 cookie 或伪造副本。
I'll answer #5 (which renders the rest of the questions moot).
Cookies aren't designed for that sort of thing. They are make a round trip with every HTTP requests - including on same domain CSS, images, JS, etc.
I suggest you look at HTML 5 local storage or just sending the data down to the browser every time with a minimal key cookie.
For #3 - there isn't a way to fool proof way prevent someone from stealing a cookie or forging a duplicate.