iframe 是否可以有不同的会话？
我想构建一个管理工具，我可以在其中“模拟”我的网站的用户，而不必失去作为管理员的会话。
我希望能够打开一个 iframe，它将“作为用户”查看网站，而不更改打开 iframe 的页面的状态。
这可能吗？有更好的方法吗？
I am wanting to build an admin tool where I can "impersonate" users of my site, without having to lose my session as an admin.
I would like to be able to open an iframe that will view the website "as the user", without changing the state of the page that opened the iframe.
Is that possible? Is there a better way to do this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这是可能的，但有一点“但是”:)
只需几个选项即可开始：
iframe本身不会对您有太大帮助：它始终会与浏览器共享其 cookie。因此，为了避免这种情况，您可以使用上述任一选项，但这不依赖于iframe。It's possible, but there's a bit "but" :)
Just a couple options to start with:
iframeitself won't help you much: it will always share its cookies with the browser. So in order to avoid that, you can use either of the above options—but that does not depend on theiframe.什么语言？我的回答基于 PHP 是您选择的语言的假设。
首先，我想说，如果会话模拟是您可以以其他用户身份查看您的网站，同时仍保持管理员登录完整的唯一方法，那么您的应用程序计划是错误的。
您可以做到这一点的一种方法是，假设您正在使用 PHP 以及其中的默认会话管理功能，并且您没有自定义会话处理程序，则将使用
?PHPSESSID= 加载 iframe url sessionidhere参数。更好的方法是创建您的网站并通过某种用户对象对用户进行身份验证，然后添加某种 url 参数，例如
?userbrowseid=123然后，当您加载页面时，您的代码仅当您已经以管理员身份登录时才会检查该参数是否存在。然后，页面将使用 ID 为
123的用户的用户对象覆盖当前的用户对象。应采取措施确保您的会话 cookie 不会被模拟的用户对象覆盖。由于这将在 iframe 中，因此您的站点将作为管理员运行，并且 iframe 将作为用户对象加载。What language? My answer is based on the assumption that PHP is your chosen language.
Firstly, I would say you have planned your application wrong if session impersonation is the only way you can view your site as another user while still keeping your admin login intact.
One way you could do it, and again this is assuming that you are using PHP as well as the default session management functions within and you do not have a custom session handler would be to load the iframe url with the
?PHPSESSID=sessionidhereparameter.A better way to do this is to create your site and authenticate users via a user object of sorts and then add some sort of url parameter such as
?userbrowseid=123Then when you load the page, your code will only check if the parameter exists if you are already logged in as an admin. The page would then overwrite your current user object with the user object of the user with the id
123. Steps should be taken to make sure your session cookies are not overwridden with the impersonated user object. As this would be in an iframe, your site will work as an admin and the iframe will be loaded as the user object.