在JavaScript中访问PHP SESSION值

Question

I generate a session value for each visitor on my website. If they submit the form, it sends the data via a jQuery AJAX request to my PHP validator script.

This script performs several checks on the data the user submitted. If everything has been validated, it returns a sha256 hash which is generated with the function hash_hmac('sha256', 'success', $_SESSION['secret_key']) . I hash this so users cannot manipulate the response with software such as Charles.

The jQuery request receives the hashed string and I have to hash 'success' with the secret key again to check if they match. However, the secret key is stored in a PHP session and I am not able to figure out how to get access to it through JavaScript.

An AJAX request to a PHP script would not be ideal — an attacker can then edit the response to make it match with their own hashed strings.

Answer 1

I'll simply elaborate on my comments in this answer.

You say

An AJAX request to a PHP script would not be ideal — an attacker can then edit the response to make it match with their own hashed strings.

They can edit the response, but if it's all done client side, they can still edit it.

You want to send the data hashed, then you want the client to be able to check the hash, so I'm not sure what the point in hashing would be, other than security in transport. I can't tell you what you really need, because I'm not seeing the use case here.

I do know you'll either need to go to the server for something you want to keep secret from the client. There's no security on the client side.

Answer 2

As long as you are using javascript in your php file, something like this will suffice...

<script>  
   var secret_key = <?php echo json_encode($_SESSION['secret_key']); ?>  
<script>