云托管上的 PHP 会话安全
我知道在常规共享主机上，将 PHP 会话存储在默认位置 (/tmp) 可能会出现安全问题。 VPS 不存在这个问题。因此，我认为VPS云主机不会。但是常规的云托管呢？这是否只是在多台计算机上共享托管，这意味着 PHP 会话仍然容易受到该云上其他网络托管客户端的窥探？或者（非 VPS）云托管是否有什么不同之处可以防止 PHP 会话存储位置漏洞？
I know that on regular shared hosting, storing PHP sessions in the default location (/tmp) may present security issues. A VPS does not have this issue. Therefore, I assume VPS cloud hosting does not. But what about regular cloud hosting? Is that just shared hosting over multiple computers, meaning that PHP sessions would still be vulnerable to the prying eyes of other webhosting clients on that cloud? Or is there something different about (non-VPS) cloud hosting that protects from PHP session storage location vulnerabilities?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
共享主机只是意味着您的网络托管提供商将多个网站放置在一台服务器上。
共享托管的一个问题是，在单个服务器的上下文中，存在固定数量的物理空间。尽管托管提供商会以不会遇到容量问题的方式配置其服务器，但问题仍然存在。云托管通过用虚拟化和高度可扩展的基础设施取代单个物理服务器的概念来消除这种可能性。
但安全性仍然是云托管中的一个问题。唯一的区别是您的文件存储在多个服务器中。而且您不知道也不信任文件的存储位置。
因此，为了更好的会话处理和安全性，我建议您使用数据库来存储和管理会话，原因如下。
只有您有权访问会话数据。在共享主机中，这可以为您提供很大帮助。
每个服务器都有自己的目录来维护这些会话文件，因此，如果您在多个服务器之间使用负载平衡，则不能保证将对现有会话的请求发送给正在维护状态的服务器 。
站点管理员很难执行诸如“当前有多少会话处于活动状态？”之类的查询。或“哪些用户当前登录？”。但是，如果您存储在数据库中，则可以跟踪。
应用程序需要能够在没有服务器关联的多个服务器上运行。
这里是 Chris Shiflett 撰写的一篇关于在数据库中存储会话的精彩文章。
希望有帮助。
Shared hosting simply means that your web hosting provider places multiple web sites on a single server.
One issue with shared hosting is that within the context of a single server, there is a fixed amount of physical space. Although the hosting provider will provision their servers in such a way that you don’t run into capacity problems, the issue still remains. Cloud hosting removes that possibility by replacing the concept of the individual physical server, with that of a virtualized and highly scalable infrastructure.
But the security is still a concern in cloud hosting. The only difference is that your files are stored in multiple servers. And you do not know and trust where the files are stored.
So for better session handling and security I will advice you to use database to store and manage sessions for the following reasons.
Only you have access to the session data.In shared hosting this can help you a lot.
Each server will have its own directory where these session files are maintained, so if you are employing load balancing across multiple servers there is no guarantee that a request for an existing session will be given to the server which is maintaining the state for that session.
It would be difficult for a site administrator to perform such queries as "how many sessions are currently active?" or "which users are currently logged in?".But if you are storing in the database then you can track.
The application needs to be able to run on multiple servers without server affinity.
Here is a great article about storing sessions in database by Chris Shiflett.
Hope it helps.
我可能是错的，但大多数“云托管”服务（例如“VPS”服务）只是云服务器上的共享托管，主机可根据需要进行扩展。
我唯一一次发现将会话存储在“/temp”中是安全的，是当我是唯一使用该服务器的人时。
I could be wrong, but most "cloud hosting" services, as in not a "VPS" service, is just shared hosting on a cloud server that the host scales up as needed.
The only time I find storing sessions in, say for example "/temp", secure, is when I'm the only the only person using the server.