基于php session提高Web应用安全性

Question

I have a web application that I want to improve in its security flaws, I read a lot of articles about it but some questions are still unanswered.我有一个 Web 应用程序，我想改进其安全漏洞，我阅读了很多关于它的文章，但仍有一些问题没有得到解答。 I appreciate your help.我感谢您的帮助。

First of all I have a login screen.首先，我有一个登录屏幕。 After the user enters his credentials, they are checked against the database ( they are properly hashed ;)), and if it succeeds the server creates a session variable用户输入他的凭据后，将根据数据库检查它们（它们已正确散列;)），如果成功，服务器将创建一个会话变量

//Jhon id = 1    
$_SESSION["userID"]= '1';

At the beginning of every php file (eg dashboard.php) I have the following code:在每个 php 文件（例如dashboard.php）的开头，我都有以下代码：

       session_start();
        if(isset($_SESSION['userID'])) {
            if($_SESSION["userID"]==""){header("location:login.php");}
        }else{
            header("location:login.php");
        } 
?>
    <html ...

For improve maintenance i want to include this code in an external php file like为了改进维护，我想将此代码包含在外部 php 文件中，例如

include('inc/restricted.php');
?>
        <html ...

My two main questions are:我的两个主要问题是：

1) If an intruder handles to corrupt or to deny access to restricted.php, would the remain of dashboard.php show up? 1) 如果入侵者处理损坏或拒绝访问restricted.php，dashboard.php 的剩余部分会显示吗？ Is it possible to do something like that?有可能做这样的事情吗？ If it is, how could I fix it the way I can include the security code as an external file?如果是，我该如何修复它，我可以将安全代码作为外部文件包含在内？

2) As you see the value of my session variables are simple (integers numbers), should I change them to hashed values? 2) 如您所见，我的会话变量的值很简单（整数），我应该将它们更改为散列值吗？ I thought the php session was stored on server side but i read about some php session variables stored on cookies and now im worried about the chance of create a cookie with a random number and granted access.我认为 php 会话存储在服务器端，但我读到了一些存储在 cookie 上的 php 会话变量，现在我担心使用随机数创建 cookie 并授予访问权限的机会。

Answer 1

It's possible if the code in this file is insecure.如果此文件中的代码不安全，则有可能。 Since we can't see it it's impossible to say how it could be compromised.因为我们看不到它，所以不可能说它是如何被破坏的。 But generally speaking, the web-facing request should have no ability to control your php code unless you have a severely insecure setup.但一般来说，除非您的设置非常不安全，否则面向 Web 的请求应该无法控制您的 php 代码。
The values don't matter.价值观不重要。 Data stored in $_SESSION is never stored on the client, only on the server.存储在$_SESSION数据永远不会存储在客户端上，只存储在服务器上。 This is controlled in php by the session.handler interface (by default it's stored as a plain-text file on your server in session.save_path ).这在 php 中由session.handler接口控制（默认情况下，它作为纯文本文件存储在您的服务器上的session.save_path ）。

The things that tend to make sessions insecure are almost always the result of poorly written code or a poorly configured server.往往使会话不安全的事情几乎总是由于编写不当的代码或配置不当的服务器造成的。

Some things you can do to improve the security of your sessions are outlined below:下面概述了您可以采取的一些措施来提高会话的安全性：

Always use session_regenerate_id(true) when logging the user in ( this prevents session fixation attacks ).登录用户时始终使用session_regenerate_id(true) （这可以防止会话固定攻击）。
Always delete the session cookie on the client when you log the user out ( see the first example in http://php.net/session-destroy ).当您注销用户时，始终删除客户端上的会话 cookie（请参阅http://php.net/session-destroy 中的第一个示例）。 This prevents session take-over attacks when the user is logged in from a public computer, for example, as the session may not always be deleted instantly on the server side and the cookie allows the client to re-trigger the session TTL on the server.这可以防止用户从公共计算机登录时的会话接管攻击，例如，因为会话可能不会总是在服务器端立即删除，cookie 允许客户端在服务器上重新触发会话 TTL .
Only transmit session cookies over a secure connection (See session.cookie_secure仅通过安全连接传输会话 cookie（请参阅session.cookie_secure
To prevent some XSS and CSRF vectors consider using session.cookie_httponly and session.cookie_samesite to prevent malicious JS from opening up these kinds of attacks.为了防止一些 XSS 和 CSRF 向量，可以考虑使用session.cookie_httponly和session.cookie_samesite来防止恶意 JS 开启这些类型的攻击。
Always use CSRF tokens along with all modifying requests to protect the user from compromising their access strictly via sessions.始终将CSRF 令牌与所有修改请求一起使用，以保护用户不会严格通过会话破坏他们的访问。 This is an added layer of security.这是额外的安全层。

Just remember that this is not an unabridged list.请记住，这不是一个完整的列表。 Security is built in layers and requires a lot of forethought in use cases and objectives.安全性是分层构建的，需要对用例和目标进行大量的深思熟虑。

基于php session提高Web应用安全性

问题描述

1 个解决方案

解决方案1
2 已采纳 2020-01-26 20:02:00

基于php session提高Web应用安全性

问题描述

1 个解决方案

解决方案1 2 已采纳 2020-01-26 20:02:00

解决方案1
2 已采纳 2020-01-26 20:02:00