PHP ::: 安全 SESSION_ID ::: 没有 CSRF？

发布于 2024-12-29 14:30:39 字数 951 浏览 1 评论 0原文

使用这个：

function nonce($str,$expires){
return sha1(date('Y-m-d H:i',ceil(time()/$expires)*$expires).$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'].$salt.$str);
}

假设我在登录后初始化我的session_id，同时生成指纹，如下所示：

session_regenerate_id();
$_SESSION['thumbprint']=nonce(session_id().'thumbprint',86400);

并调用这些：

function valid_session(){
    return ($_SESSION['thumbprint']==nonce(session_id().'thumbprint',86400));
}

function logged_in(){
    return (valid_session()&&isset($_SESSION['user']['id'])&&isset($_SESSION['user']['typeid'])&&isset($_SESSION['user']['email']));
}

在每个页面的顶部：

if(logged_in==false){//logout & redirect back to index}

在这样的审查下使用指纹，我什至需要为每个函数调用制作令牌或者这种实现足以防止 CSRF 吗？

::: 86400 是 24 小时，我意识到这是一个很长的时间。对于真正的唯一 ID 来说，这是否太长了？
::: 当我说安全函数时，我的意思是可以通过使用相同的随机数或令牌来保护函数。

原文

Using this:

function nonce($str,$expires){
return sha1(date('Y-m-d H:i',ceil(time()/$expires)*$expires).$_SERVER['REMOTE_ADDR'].$_SERVER['HTTP_USER_AGENT'].$salt.$str);
}

Let's say I initialize my session_id after I log in, also generating a thumbprint, like this:

session_regenerate_id();
$_SESSION['thumbprint']=nonce(session_id().'thumbprint',86400);

And call these:

function valid_session(){
    return ($_SESSION['thumbprint']==nonce(session_id().'thumbprint',86400));
}

function logged_in(){
    return (valid_session()&&isset($_SESSION['user']['id'])&&isset($_SESSION['user']['typeid'])&&isset($_SESSION['user']['email']));
}

At the top of every page:

if(logged_in==false){//logout & redirect back to index}

With a thumbprint under such scrutiny do I even need to make tokens for each function call or is this implimentation sufficient to protect against CSRF?

::: 86400 is 24 hours which I realize is a long time. Is that too long to realy on a unique ID for?
::: When I say secure functions I mean functions could be secured by using the same nonce or a token.

分享到QQ

分享到微博