简体繁体 English

在会话中存储信用卡信息是否“可以”？

[英]Is it 'ok' to store credit card information in the session?

原文 2009-10-01 05:39:21 6 6 asp.net/ session

I was thinking that was a good place because it is so temporary yes? 我觉得这是一个好地方，因为它是如此暂时的是吗？ I guess when I say 'ok' I mean both secure and ethical as well as practical for the code side of things. 我想当我说'ok'时，我的意思是既安全又道德，也适用于代码方面。 Please advise. 请指教。

6 个解决方案

If you are storing credit card data anywhere it should be fully encrypted! 如果您将信用卡数据存储在任何地方 ，应该完全加密！ Storing in the session may be necessary, perhaps you've got a multi-part form to fill out, but it should be purged as soon as possible. 在会话中存储可能是必要的，也许你有一个多部分表格来填写，但它应该尽快清除。

Carefull with PHP sessions on shared hosts. 小心共享主机上的PHP会话。 Other users on the same host can steal sessions by creating a simple script that can open your sessions by manually setting the session_id then calling session_start(); 同一主机上的其他用户可以通过创建一个简单的脚本来窃取会话，该脚本可以通过手动设置session_id然后调用session_start（）来打开会话。 If you must store CC nums use db stored sessions that are encrypted and delete promptly. 如果必须存储CC nums，请使用已加密的db存储会话并立即删除。 Its in the users best interest to re-ask for the number when needed, savy web users will thank you for it. 在用户最好的兴趣是在需要时重新询问号码，精明的网络用户会感谢你。

Keep in mind that session state may be stored in a database (depending on the configuration). 请记住，会话状态可能存储在数据库中（具体取决于配置）。 Even if it is temporary in its nature I would make an effort to deal with the value the shortest time possible, and probably try to stay away from the session. 即使它本质上是暂时的，我也会努力在最短的时间内处理价值，并可能试图远离会话。

Listen to episode #109 of Security Now! 立即收听安全第109集！ with Steve Gibson. 与史蒂夫吉布森。

http://www.grc.com/securitynow.htm http://www.grc.com/securitynow.htm

In that episode, Steve details how he built his own eCommerce system that stores data in exactly the way you're describing. 在那一集中，史蒂夫详述了他如何构建自己的电子商务系统，以完全按照您描述的方式存储数据。 He doesn't store anything on the server side, but rather collects the data, encrypts and signs it into a binary blob that can't be modified (otherwise the signature won't match when it's resubmitted), and stores it in a hidden form field on the client. 他没有在服务器端存储任何内容，而是收集数据，加密并将其签名为无法修改的二进制blob（否则签名在重新提交时将不匹配），并将其存储在隐藏中客户端上的表单字段。

The absolute best answer? 绝对最好的答案？

No. Don't do it. 不，不要这样做。

The credit card details should be the last portion of your checkout process. 信用卡详细信息应该是结帐流程的最后一部分。

Better yet, store it in application state. 更好的是，将其存储在应用程序状态。 More better access. 更好的访问。 Your controls can bind directly against that as well. 您的控件也可以直接绑定。