记住用户复选框的良好安全方法
我有一个登录页面，要求输入用户名和密码。该页面有一个复选框“记住我”。
身份验证是：对于提供的用户名，使用与用户数据库记录一起存储的盐将提供的密码转换为哈希值，并将该哈希值与存储的哈希值进行比较。
当用户勾选该框时，我应该在他们的 cookie 中存储什么，以便他们下次访问时自动登录？
我认为一个好方法是将他们的用户名和密码的散列值存储在 cookie 中，并在用户下次访问时重新验证用户身份。这些盐将被保存在数据库中。
I have a login page which asks for a username and password. This page has a checkbox "Remember Me".
Authentication is: For the username provided, convert the provided password to a hash using the salt stored with the user db record and compare the hash to the stored hash.
When a user ticks the box, what should I store in their cookie so they auto login next time they visit?
I was thinking that a good way was to store their username and a hashed value of their password in a cookie and to re authenticate the user on their next visit. The salt will be kept away stored in a database.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
我不会在客户端 cookie 中存储散列密码。我将在用户和长期会话之间创建另一个抽象。我将首先阅读以下文章，以获得有关挑战的一些想法：
http:// Fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/
该文章的关键部分是并非所有登录都应该生而平等。
I would not store hashed passwords in the client cookie. I would create another abstraction between users and long lived sessions. I would start by reading the following article to get some ideas about the challenges:
http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/
The key part from that article is that not all logins should be created equal.
这取决于您想要维护的安全级别。当我选中“记住我”框时，我只希望它记住我的用户名。我仍然想像往常一样提供我的密码。
在 cookie 中存储用户名和散列密码对我来说似乎是个坏主意。
It depends on the level of security you want to maintain. When I check a "Remember Me" box, I only want it to remember my username. I still want to provide my password as normal.
Storing username and hashed password in a cookie, seems like a bad idea to me.
如果您确实想让用户保持登录状态，那么您应该在 cookie 中存储唯一的登录令牌，而不是用户名或散列密码。当您的服务器收到登录令牌时，您可以将其与持久登录用户的数据库进行比较，并查看该令牌对应于哪个用户。服务器应存储登录令牌、与该令牌关联的用户名以及到期时间。一旦使用了令牌，它就应该失效，因此不能重复使用。
这最大限度地减少了泄露给客户端的信息，并且限制了攻击者在设法窃取 cookie 的情况下恢复合法用户密码的机会（这相对容易做到）。
我强烈建议您在所有 cookie 上设置安全标志，以便它们仅通过安全连接发送，并确保持久登录的超时时间相对较短。此外，最好进行额外的授权检查，例如确保登录令牌与特定 IP 地址或浏览器指纹相关联，以帮助防止偶然攻击。这仍然不会严重阻碍坚定的攻击者，但可能会阻止一些脚本小子。
最后，请考虑采纳@Craig T 的建议，只记住用户名，而不是让用户保持登录状态。持久登录非常危险，因此您应该仔细考虑用户从中获得的价值与潜在成本。
非常感谢您在数据库中正确存储了密码！令人惊讶的是有多少人认为他们不需要盐。
If you really want to keep a user logged in then you should store a unique login token in a cookie, not the username or hashed password. When your server receives a login token you can compare it with your database of persistently-logged-in-users and see which user the token corresponds to. The server should store the login token, the username associated with that token, and an expiry time. Once a token has been used it should be invalidated so it cannot be reused.
This minimizes information leaked to the client, and it limits the opportunities for an attacker to recover a legitimate user's password if they manage to steal the cookie (which is relatively easy to do).
I highly recommend that you also set the secure flag on all your cookies so they are only sent across secure connections, and make sure you have a relatively short timeout on persistent logins. Also, it's a good idea to have additional authorization checks, such as making sure the login token is associated with a particular IP address or browser fingerprint, to help prevent casual attacks. This still won't seriously hinder a determined attacker but might dissuade some script kiddies.
Finally, please consider taking @Craig T's advice and only remember the username, rather than keeping a user logged in. Persistent logins are very dangerous so you should think carefully about the value your users get from this vs the potential costs.
Good on you for correctly storing your passwords in your DB! It's amazing how many people think they don't need salts.