如何防止欺骗性发布到 PHP 类/类系统
我正在尝试制作一个类似/不同的系统，当用户在帖子上单击“喜欢”时，他/她的用户ID（存储在会话中）和帖子ID将通过ajax调用存储在数据库中。
然后我想，如果某个用户在另一个域上制作一个带有不可见输入字段（其中有他的帖子 ID 之一）的 html 表单，并将其链接提供给已检查“稍后记住我”或正在查看我的网站的用户，会怎么样。
用户将单击按钮，表单会将帖子 ID 发布到我的网站，会话包含用户 ID，这些将存储在数据库中。
我想不出什么好的解决办法。有没有比 HTTP 引用更可靠的方法来防止这种情况发生？
提前致谢
I am trying to make a like/unlike system, when a user clicks like on a post, his/her user id (which is stored in a session) and the post id will be stored in a database through an ajax call.
Then I thought what if some user make a html form with invisible input field (which has one of his post ids) on another domain and give its link to a user who checked remember me later or is viewing my site.
The user will click the button and The form will POST post id to my site, session contains user id and these will be stored in database.
No good solution comes to my mind. Is there any way more reliable than HTTP referrer to prevent this?
Thanks in advance
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
一种方法是将特定于用户会话的秘密变量插入到 HTML 中。这可以防止跨站点伪造。
在 PHP 中，您将生成一个随机“密钥”并将其存储在会话中：
然后在表单中，您将添加为隐藏变量：
您应该通过 POST 提交表单，最好通过 HTTPS 提交，这会使其变得更难（但不是不可能）截获 chkVar 的值。
在处理您发布的表单的代码中，将发布的 chkVar 与您的会话变量进行比较。在理想情况下，每个请求都会有一个唯一的 chkVar，但是使用整个会话中相同的 chkVar 通常效果很好，并且可以防范大多数 csrf 攻击。
One way is to insert a secret variable into the HTML which is specific to a user's session. This can prevent cross site forgery.
In PHP you'd generate a random 'key' and store it in the session:
Then in a form, you'd add as a hidden variable:
You should submit your form via POST and preferably over HTTPS, making it harder (but not impossible) to intercept the value of chkVar.
In the code that processes your posted form, compare the posted chkVar against your session variable. In an ideal world, you'd have a unique chkVar per request, however using one which is the same for an entire session often works fine and guards against most csrf attacks.
您正在谈论 CSRF 漏洞。
这是一个很好的安全问题。
它通常使用只有服务器知道的密钥进行管理。
此密钥必须在您的所有表单中使用。
这是一个小教程来防范它
You are talking about CSRF exploit.
This is a good security question.
It's generaly managed with a key that is only known by the server.
This key have to be used in all your forms.
Here is a little tutorial to protect against it
您应该发送的唯一内容是帖子 ID，用户 ID 应该在您通过 AJAX 调用的脚本中自动获取。假设您已验证用户已登录，则您拥有这两条信息，而不会产生任何进一步的安全风险。
The only thing you should be sending is the post id, the user id should be picked up automatically in the script you are calling through AJAX. Assuming you have validated the user is logged in, you have both pieces of information without any further security risk.