电子商务会话数据持久化
我目前正在为电子商务网站构建购物车，并且想知道在结帐过程中在会话中保留用户数据的最佳方法。
用户流程工作如下：
购物车->登录/注册->选择送货地址->确认->我
的问题是，一旦用户登录，我想显示他们的送货地址列表，以便他们可以选择一个。最简单的方法是通过用户的 ID 查询模型，但我担心的是安全性 - 我的第一个想法是将用户 ID 存储在会话中，然后用它来检索地址。然而，没有什么可以阻止其他用户可能劫持该 ID（仅通过猜测随机数）并泄露其他用户的地址。我也许可以使用他们的电子邮件地址，但这也可能被猜到。我最好的选择是结合使用两者，还是有更好的方法？
I'm currently building a shopping cart for an eCommerce site and am wondering about the best way to persist user data in the session during the checkout process.
The user flow works is as follows:
shopping cart -> login/register -> select delivery address -> confirm -> pay
My issue is once a user is logged in, I want to display a list of their delivery addresses so they can select one. The easiest way to do this is querying the model by the user's id, but my concern is for security - my first thought was to store the user id in the session and then use this to retrieve the addresses. However there's nothing to stop another user potentially hijacking this id (just by guessing random numbers) and revealing addresses for other users. I could perhaps use their email address, but this too could potentially be guessed. Is my best bet to use a combination of the two, or is there a better way?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
PHP 具有内置会话功能。它将唯一的 cookie 加载到浏览器，并允许您通过
$_SESSION数组将所有会话数据保留在服务器端。 Cookie ID 对于会话而言是唯一的，而不是对于用户来说是唯一的，因此每次用户登录时它都会发生变化（如果 Cookie 已过期）。如果您使用 https 进行会话，则非常安全。如果没有 https，会话很容易受到具有（特殊）知识并有拦截 cookie 数据倾向的人的攻击，尽管这种拦截并不容易。根据您想要的安全程度，您可能可以接受也可能不接受不使用 https 的运行。您可以在此处阅读有关 PHP 会话功能的更多信息：
http://php.net/manual/en /features.sessions.php
PHP has built-in session capability. It loads a unique cookie to the browser and allows you to keep all session data on the server-side via the
$_SESSIONarray. The cookie ID is unique for the session, not the user, so it changes each time the user signs in (if the cookie has expired). If you conduct the session in https, it's very secure. Without https, the session is vulnerable to someone with the (special) knowledge and inclination to intercept the cookie data, though such an interception is not easy. Depending on how secure you want to be, running without https may or may not be acceptable for you.You can read more about PHP session capability here:
http://php.net/manual/en/features.sessions.php