简体繁体 English

Laravel 5.2通过登录获得持久会话ID，可以使用_token吗？

[英]Laravel 5.2 persistent session id through login, ok to use _token?

原文 2016-10-21 07:28:46 6 2 php/ laravel/ session/ laravel-5.2/ session-variables

I need to reserve items in my database when a user adds them to his/her basket. 当用户将项目添加到他/她的购物篮时，我需要在数据库中保留项目。 I am currently using the session id ( Session::getId() ) however this is regenerated at login. 我当前正在使用会话ID（ Session::getId() ），但这是在登录时重新生成的。 Whilst you can shop as a guest, to checkout you must register. 您可以以客人的身份购物，但要结帐，您必须注册。

If i take a look at all session variables with $request->session()->all() i have come across the _token , this looks like a unique string and it does not regenerate at login, i was therefore thinking of using this for my baskets? 如果我使用$request->session()->all()查看所有会话变量，我遇到了_token ，这看起来像一个唯一的字符串，并且在登录时不会重新生成，因此我在考虑使用此方法为我的篮子？

Is this safe? 这样安全吗？

If not alternatively i would have to generate my own uuid's in PHP and store them as basket_id or something, this would save me having to do this. 如果不是这样，我将不得不在PHP中生成自己的uuid并将其存储为basket_id或其他内容，这将使我不必这样做。

Many thanks in advance. 提前谢谢了。

2 个解决方案

Okay, so I copy my comment here: 好吧，所以我在这里复制我的评论：

_token is to defend against csrf attack. _token用于防御csrf攻击。 More here: laravel.com/docs/5.3/csrf 此处更多信息： laravel.com/docs/5.3/csrf

_token field is unique per request. _token字段对于每个请求都是唯一的。 You can send this token as request variable or cookie. 您可以将此令牌作为请求变量或Cookie发送。

Remember - by default all post actions need this field (one of middlewares keep eye on this). 请记住-默认情况下，所有发布操作都需要此字段（中间件之一关注此字段）。

You have access to token value by function csrf_token() - or csrf_field() to get HTML input field. 您可以通过函数csrf_token()或csrf_field()访问令牌值以获取HTML输入字段。

Laravel has a database driver for sessions, https://laravel.com/docs/5.3/session#driver-prerequisites . Laravel有一个用于会话的数据库驱动程序， https: //laravel.com/docs/5.3/session#driver-prerequisites。

Using that you can reference the session table in your reserved items table. 使用它，您可以在保留项目表中引用会话表。 You will know whether a user is a guest. 您将知道用户是否为访客。

You can even see the last activity and base your reserved items on that. 您甚至可以查看上一个活动，并在此基础上保留您的项目。