任何人都可以轻松获取您的 $_COOKIE 数据吗？
他们所需要的只是您的 cookie 文件，然后服务器就会授予他们 cookie 存储的任何访问权限吗？或者还有比这更多的事情吗？因为我计划对一些 cookie 数据进行 MD5 处理，但希望确保某人不容易获取并模仿该数据。
Do all they need is your cookie file and then the server will just grant them whatever access that cookie stores? Or is there more to it than that? Because I plan to md5 some cookie data but want to make sure it isn't very easy for someone to grab that data and mimic it.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
你的问题令人困惑。 Cookie 是存储在客户端计算机上的信息，每次请求时都会发送到服务器（通常是指示客户端存储它的请求，但不一定）。
因此，任何在服务器将 cookie 发送到客户端（用于存储）或客户端发送到服务器时拦截 cookie 的人都可以重现 cookie（因此，服务器将获取
$_COOKIE的值） ）。不幸的是，cookie 经常存储的信息一旦被拦截，攻击者就可以冒充其他用户。为了避免拦截，必须使用https。对于偶然的攻击者来说，拦截并不是小事（除了未受保护的 WiFi 网络），但对于政府、ISP 和网络管理员来说，拦截却是触手可及的。
但你的问题引起了更大的担忧：
根据这到底意味着什么，这可能是一个非常不安全的设置。任何客户端都可以伪造 cookie，即，即使服务器从未告知特定客户端存储该 cookie，也可以发送 cookie。因此，如果您正在执行类似
md5('is_admin:1')之类的 cookie 值存储之类的操作，请注意，任何人都可以伪造该数据，尽管有 md5 哈希值（只要他可以推断出其值）格式）。Your question is confusing. A cookie is information stored on the client's computer that's sent to the server on every request (typically the one that instructed the client to store it, but not necessarily).
Therefore, anyone which intercepts the cookie while it's being sent by the server to client (for storage) or by the client to the server can reproduce the cookie (hence, the server will get the value for
$_COOKIE).Unfortunately, cookies frequently store information that, if intercepted, allows an attacker to impersonate another user. To avoid interception, https must be used. Interception is not trivial for the casual attacker (except on unprotected WiFi networks), but it's within reach for governments, ISPs and network administrators.
But your question raises bigger concerns:
Depending on what exactly this means, this may be a very insecure setup. A cookie can forged by any client, i.e., it can be sent even tough the server never told that specific client to store that cookie. So if you're doing something like storing in the cookie values like
md5('is_admin:1'), know that anyone can forge that data, despite the md5 hash (as long as he can infer its format).是的，每个嗅探任何人 cookie 的人都可以使用它们，除非您使用 https 协议。然而，即使是 FTP 并且攻击者可以直接访问该机器，他也可以毫无问题地使用这些 cookie。您可以通过 https 保护它们或检查 IP 地址/确切的用户代理匹配。
Yes, everyone who sniffes anyone's cookie can use them, unless you're using https protocol. However, even if it's FTP and attacker has direct access to that machine, he can use these cookies without problems, too. You can secure them by https or check ip address/exact user agent match.
cookie 只是客户端作为请求的一部分发送到服务器的东西。那么（理论上），可以将其从一个浏览器传输到另一个浏览器，在某个中央位置同步它，等等。如果某人能够读取另一个人的 cookie，那么该人完全能够“窃取”凭据。
在这种特殊情况下，可以通过使用 HTTPS 加密协议来增加很多安全性。但是，即使如此，根据浏览器的实现，如果用户的计算机受到损害并且 cookie 文件本身被复制，理论上也有可能被突破。当然，如果用户的计算机受到损害，实际上无能为力。
最好的选择是使用 HTTPS。一旦完成，您就已尽一切努力来保护连接和与之相关的 cookie。
A cookie is simply something which is sent as a part of the request by the client to the server. It is possible, then (theoretically), to transfer it from one browser to another, synchronize it in some central location, etc. If someone is able to read another's cookies then that person is fully able to "steal" the credentials.
In this particular case, there is a lot of security which can be added by use of the HTTPS encryption protocol. But, even there, depending on the implementation of the browser, if the user's computer is compromised and the cookie files themselves are copied, it is theoretically possible to break through even that. Of course, if a user's computer is compromised, there really isn't much which can be done.
Your best bet is to use HTTPS. Once that is done, then you have done everything you can to secure the connection and the cookies related to it.
是的，通常只需要会话令牌 cookie。在大多数应用程序中，如果会话令牌被泄露，则会话可能被劫持并且用户可能被冒充。
回答你的第二个问题，cookie 被拦截和泄露可能非常容易，也可能非常困难。取决于你如何保护它们。
保护 cookie 的主要防御措施是使用 SSL/TLS 加密客户端和服务器之间的连接。如果您在没有 SSL/TLS 的情况下传输 cookie，则同一网络上的任何人或可以看到两者之间网络的人都可以以明文形式看到该 cookie 并使用它。因此，如果您关心 cookie 安全性（和会话安全性），请使用 SSL/TLS。
我很好奇。
这有什么意义？如果您想确保 MD5 数据受到保护，为什么要将其存储在 cookie 中？如果需要保护，则需要留在服务器上。
Yes, the session token cookie is usually all that is needed. In most application, if a session token is compromised then the session can be hijacked and the user can be impersonated.
To answer your second question, it can be very easy or very difficult for cookies to be intercepted and compromised. Depending on how you protect them.
The primary defense for protecting cookies is using SSL/TLS to encrypt the connection between the client and server. If you are transmitting cookies without SSL/TLS then anyone on the same network or who can see a network between the two can see that cookie in plaintext and use it. So, if you care about cookie security (and session security) USE SSL/TLS.
I am curious.
What is the point of this? Why would you MD5 data and store it in a cookie if you want to make sure it is protected? If it needs to be protected it needs to stay on the server.