尝试了解 CakePHP cookies &验证
我正在尝试找出 CakePHP cookie 并满足我稍微不寻常的身份验证要求。
我有一个基于 CakePHP 的数据收集系统，现在正在与使用 COTS 软件构建的报告系统集成。报告系统需要进行访问控制，除非我想复制两个系统中的所有用户帐户，否则我需要报告系统能够查明用户是否在我的 CakePHP 系统中经过身份验证。
报告系统允许我在客户端的报告请求首次到达时加载 Java 类并执行函数。所以我的想法是
- 检查传入的报告请求并提取我的 CakePHP 站点用于身份验证/会话识别的 cookie
- 将请求从 Java 函数发送到 CakePHP 站点内的“reportauth”操作，并附加此 cookie
- CakePHP 中的 reportauth 操作然后检查用户是否登录到 CakePHP 站点，并向标识用户角色的 Java 函数返回加密响应。
我可以获取 cookie，在请求中发送它，并且可以单独在 PHP 和 Java 之间共享加密信息。
但是，当我在 Java 请求中使用“新鲜”cookie（新登录后我的浏览器通过请求重复发送到 CakePHP 站点的 cookie）时，响应显示用户尚未登录。如果我随后在浏览器中重新加载该网站，我就会退出。我怀疑cookie中可能有一些关于用户代理（？）的额外信息，这会导致Java源请求被抛出，并且为了安全起见该会话被销毁，但我对系统不太了解。我想我可能会看到 CakePHP 可以防止会话劫持（这通常会让我很高兴）。
谁能告诉我是否有办法解决这个问题？最好是不涉及 CakePHP 中的自定义身份验证组件，因为数据收集站点已经上线，并且我的报告截止日期已经不远了。
非常感谢任何帮助。
I'm trying to figure out CakePHP cookies and meet my slightly unusual authentication requirements.
I have a CakePHP-based data collection system that is now being integrated with a reporting system built with COTS software. The reporting system needs to be access controlled and unless I want to duplicate all user accounts in both systems I need the reporting system to be able to find out if the user is authenticated in my CakePHP system.
The reporting system permits me to load a Java class and execute a function when the client's report request first arrives. So my idea was to
- Inspect the incoming report request and extract the cookie used by my CakePHP site for authentication / session identification
- Send a request from the Java function to a 'reportauth' action within the CakePHP site with this cookie attached
- The reportauth action within CakePHP then checks if the user is logged in to the CakePHP site and returns an encrypted response to the Java function identifying the user's role
I can get the cookie, send it in a request, and separately I can share encrypted information between PHP and Java.
However, when I use a 'fresh' cookie (the cookie that my browser repeatedly sends with requests to the CakePHP site after a new login) in my Java request the response says the user is not logged-in. If I then reload the site in my browser I have been logged-out. I suspect that there may be some extra information in the cookie about user-agent (?) that causes the Java-sourced request to be thrown out and that session destroyed for safety, but I don't know the system well enough. I think I might be seeing CakePHP protecting against session hijacking (which, ordinarily, would make me happy).
Can anyone tell me if there is a way around this issue? Preferably one that doesn't involve custom auth components in CakePHP as the data collection site is already live and my reporting deadline is not far away.
Any help much appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
一种解决方法：
让 CakePHP 将随机令牌存储在单独的 cookie 中，并作为用户表中的字段。
然后让Java应用程序抓取令牌，并将其发送到cakephp应用程序以获取用户的详细信息。
或者，让它使用 CakePHP 应用程序本身进行身份验证，并传入 会话 ID 要吃蛋糕，请使用正确的会话。请注意，需要在调用 session_start() 之前完成该函数的设置。
One workaround:
Get CakePHP to store a random token in a separate cookie, and as a field in the user table.
Then get the Java application to grab the token, and send it to the cakephp application to get the user's details.
Alternatively, have it authenticate with the CakePHP app itself, and pass in the session id to have cake use the right session. Note, setting with that function needs to be done before session_start() is called.