所有打开的窗口都具有相同的 sessionid 吗？
是否可以让同一个会话在 php 应用程序中的多个打开的窗口中处于活动状态？
我希望拥有可怕的“记住我”复选框类型系统的一些便利，而又不对用户数据造成相同程度的风险。
我遇到的具体用例是这样的：当用户收到“好友请求”时，系统会向他们发送一封电子邮件，其中包含一个链接，其中包含随机哈希值以及 URL 中的用户名。假设此人已在一个窗口中登录我的服务，并正在另一个窗口中检查其邮件中是否有确认电子邮件。他们单击确认电子邮件中的链接，然后会启动第三个窗口，该窗口向相关确认页面发起 GET 请求。我想这样做，如果用户已经在另一个窗口中登录到该服务，并且哈希值和用户名与我数据库的“请求”表中存储的哈希值和用户名匹配，则单击链接会立即确认该朋友。但是，如果他们尚未在另一个窗口中登录，则他们将被迫登录以确认好友请求。
目前，如果某人在另一个窗口中登录，单击该链接将启动第三个窗口，并且该人必须再次登录，无论他们是否有另一个打开的会话。
如果不使用 cookie 来维持持久登录，是否可以实现此功能？
更新：这个问题表明我对会话的工作原理缺乏了解。默认情况下，用户的会话通常会在同时打开的浏览器窗口中保留。正如我接受的答案中所解决的，问题是我打开了一个以 www.example.com 作为 URL 的窗口，另一个以 example.com 作为 URL，在这种情况下，会在第二个窗口中创建一个不同的会话，而不是而不是继续在第一个窗口中开始的会话。
Is it possible to have the same session be active across multiple open windows in a php app?
I want to have SOME of the convenience of the dreaded "remember me" checkbox type system without the same amount of risk to the user's data.
The specific use case I have run into is this: When a user receives a "friend request", an e-mail is sent to them with a link that contains a random hash and their username in the url. Say the person is already logged in to my service in one window and is checking their mail for the confirmation e-mail in another. They click the link in the confirmation e-mail and it launches a third window which initiates a GET request to the relevant confirmation page. I'd like to make it so that if the user is already logged in to the service in another window and the hash and username match those stored in the "requests" table of my database, clicking the link instantly confirms the friend. However, if they are not already logged in in another window, they are then forced to log in to confirm the friend request.
Currently if a person is logged in in another window, clicking the link launches a third window and the person must log in again regardless of whether they have another open session.
Is this functionality possible without using cookies to maintain a persistent login?
Update: This question demonstrates my own lack of understanding regarding how sessions work. The user's session IS normally preserved across concurrently open browser windows by default. The issue, as was addressed in the answer I accepted was that I had one window open with www.example.com as the URL and one with example.com as the URL, in which case a different session is created in the second window rather than continuing the session started in the first window.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您使用基于 cookie 的会话，则会话已在（同一浏览器可执行文件的）窗口之间维护。
在这种情况下，会话 ID 是唯一的客户端存储令牌，并且浏览器通常不会在不同窗口之间隔离 cookie。
您可能会遇到问题，因为他们通过两个不同的域名访问您的网站（
www.example.comvsexample.comvswww.example .org等），但从根本上来说没有问题，除非您尝试使用 GET 传递的会话 ID。从技术上讲，您将“使用 cookie” - 但 cookie 只保存会话 ID，而不保存会话内容。如果这对您来说是一种厌恶，您可以使用 HTML5 LocalData API、Flash 对象、Java 小程序或其他任何方式来存储会话 ID...
我强烈建议不要尝试识别客户端后验< /em> 通过他们的 IP 地址或浏览器特征。只需让他们存储一个令牌，并用它来确定他们是谁。
If you use cookie-based sessions, the session is already maintained between windows (of the same browser executable).
The session ID is the only client-side stored token in this case, and browsers don't generally segregate cookies between different windows.
You may have an issue in that they're visiting your web site via two different domain names (
www.example.comvsexample.comvswww.example.org, or the like), but fundamentally there is no problem unless you try to use GET-passed session IDs.You will technically "use cookies" - but the cookies only hold the session ID, not the session contents. If that is anathema to you, you could store the session ID using the HTML5 LocalData API, or with a Flash object, or a Java applet, or whatever...
I strongly advise against attempting to identify the clients a posteriori via their IP address or browser characteristics. Just have them store a token, and use that to determine who they are.
典型的登录系统有会话和cookie。仅当用户希望被记住以避免再次从该特定浏览器输入数据时才会设置 Cookie。
会话在您登录时处于活动状态，但在您关闭窗口后将被销毁，从而提示再次登录。
将 cookie 保存到用户浏览器时，加密他们的数据至关重要。此外，保存带有参考号 (ID) 而不是密码的 cookie，而不是密码。
A typical login system has sessions and cookies . Cookies are only set if the users wants to be remembered to avoid input hes data again from that spesific browser and nothing else.
Session live while you are loggen but the will be destroyde after you close the window thus prompting for a login again.
While saving cookies to a users browser it is vital that you encrypte their data .also instead of the password save a cookie with a refrensnumber (ID) and not their password.