在Javascript和PHP之间混淆POST变量
[英]Obfuscating POST variables between Javascript & PHP
问题描述
Ideally I would want to encrypt the variables so there is no way to figure them out, however given that the client will send the variable via javascript and that anything can be decrypted if they see the code, I am looking for alternatives. 
理想情况下，我想加密变量，所以没有办法解决它们，但是假设客户端将通过javascript发送变量，并且如果他们看到代码，任何东西都可以被解密，我正在寻找替代方案。
I was thinking of making using something that would return HEX similar to md5 or sha1 but encryption and then some how incorporate the server time or date into the variable so that the encryption would only be valid for 1-2 minutes. 我正在考虑使用能够返回类似于md5或sha1的HEX的东西但加密然后将一些服务器时间或日期合并到变量中，以便加密仅在1-2分钟内有效。
The javascript would have an obfuscated/minimized function that would base the encryption on time according to javascript and then POST it to php. javascript将具有混淆/最小化的功能，该功能将根据javascript基于时间加密，然后将其发布到php。 As long as the servers date/time was withing X minutes then it would decrypt correctly. 只要服务器日期/时间持续X分钟，它就会正确解密。
I'd like to send it what seems to be random data, and get back what seems to be random data. 我想发送它似乎是随机数据，并找回似乎是随机数据。 I dont want it to be the same data. 我不希望它是相同的数据。
Is this the best method? 这是最好的方法吗？ I am only trying to stop people who try to use HTTP sniffers. 我只是试图阻止那些尝试使用HTTP嗅探器的人。 I know once they get to the javascript source nothing could prevent it given enough time/understanding of what's going on. 我知道，一旦他们进入javascript源，没有什么可以阻止它给予足够的时间/了解正在发生的事情。
If you are going to post actual code, remember that the function/ability should exist on both javascript and PHP5 (< 5.3). 如果您要发布实际代码，请记住函数/功能应该存在于javascript和PHP5（<5.3）上。 I would like native simple/small functions not implement a huge third party class for JS and PHP. 我希望原生的简单/小函数不会为JS和PHP实现一个巨大的第三方类。
Edit: SSL/HTTPS is out of the question. 编辑：SSL / HTTPS是不可能的。
4 个解决方案
解决方案1
8 2011-06-24 17:31:28
If you want to stop people from sniffing your web traffic, use https instead of http. 如果您想阻止人们嗅探您的网络流量，请使用https而不是http。
If there's one thing you should learn, it's that encryption is hard. 如果你应该学习一件事，那就是加密很难。 Really hard. 真的很难。 If you try to do it yourself, you're not going to get it right, and will likely make some subtle mistake that could bite you later. 如果你试图自己做，你就不会做对，并且可能会做出一些可能会在以后咬你的微妙错误。 It's best to leave encryption to the people who know what they're doing. 最好将加密保留给知道他们正在做什么的人。
解决方案2
4 已采纳 2011-06-24 17:34:08
I assume HTTPS is out of the question. 我认为HTTPS是不可能的。
Have you thought about ROT? 你有没有想过ROT？ Stupid simple implementation at least: 愚蠢的简单实现至少：
var output = "";
for(var i = 0; i < input.length; i++)
{
char = ( input.charCodeAt(i) + SOME_NUMBER ) %255;
output += String.fromCharacterCode( char )
}
Then, in PHP 然后，在PHP中
$chars = $_POST['chars'];
$output = "";
for($i = 0; $i < strlen($chars); $i++ )
{
$char = ord($chars[$i]) - SOME_NUMBER;
if($char < 0 )$char += 255;
$output .= chr($char);
}
解决方案3
3 2011-06-24 17:30:52
如果你想在Javascript上使用强大的PKI加密，你应该检查jcryption 。
解决方案4
0 2017-10-30 11:24:51
I suggest that AES encryption is a good option. 我建议AES加密是一个不错的选择。 You can find the JavaScript library here https://code.google.com/archive/p/crypto-js/ and PHP one https://packagist.org/packages/blocktrail/cryptojs-aes-php 你可以在这里找到JavaScript库https://code.google.com/archive/p/crypto-js/和PHP一个https://packagist.org/packages/blocktrail/cryptojs-aes-php
Now on PHP side: 现在在PHP方面：
<?php
include "vendor/autoload.php";
use Blocktrail\CryptoJSAES\CryptoJSAES;
$passphrase = "secret";
$text = "example value";
$encrypted = CryptoJSAES::encrypt($text, $passphrase);
echo "Encrypted: ", $encrypted, PHP_EOL;
It outputs: 它输出：
Encrypted: U2FsdGVkX1/JVv/nS7aExFZiatvG8Lha7MflNsfuLHo=
We take the encrypted code and decrypt it in JavaScript: 我们采用加密代码并在JavaScript中解密：
<!DOCTYPE html>
<html>
<head>
<script src="https://cdnjs.cloudflare.com/ajax/libs/crypto-js/3.1.2/rollups/aes.js"></script>
</head>
<body>
<script>
const passphrase = "secret",
encrypted = "U2FsdGVkX1/JVv/nS7aExFZiatvG8Lha7MflNsfuLHo=";
decrypted = CryptoJS.AES.decrypt( encrypted, passphrase );
console.log( decrypted.toString( CryptoJS.enc.Utf8 ) );
</script>
</body>
</html>
After firing up this HTML in a browser you get the JavaScript console: 在浏览器中启动此HTML后，您将获得JavaScript控制台：
example value
So, you can encrypt for example sensitive data in PHP and obtain in the client application with JavaScript and decrypt. 因此，您可以在PHP中加密示例敏感数据，并使用JavaScript在客户端应用程序中获取并解密。 You can do it in the opposite direction. 你可以在相反的方向做。 Just do not forget to obfuscate JavaScript and make the secret looking like some JavaScript. 只是不要忘记混淆JavaScript并使秘密看起来像一些JavaScript。
Yet you understand that it's not really secure - with considerable effort one can figure out the encryption method, find the secret and uncover the data. 但是你明白它并不是真正安全的 - 通过相当大的努力，人们可以找出加密方法，找到秘密并发现数据。
声明:本站的技术帖子网页，遵循CC BY-SA 4.0协议，如果您需要转载，请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.