PHP Session 安全
在stackoverflow上看到关于 php Session 安全的讨论，特记录之。（http://stackoverflow.com/questions/328/php-session-security）
1.使用SSL
2.重设session_id
引用
PHP中可以：session_regenerate_id(true);
3.设置session有效时间
可以参考鸟哥的文章：http://www.laruence.com/2012/01/10/2469.html
4.不是全局变量
5.存储信息在服务器上，不发送重要信息到cookie上
6.检查用户user_agent和IP
3.设置session有效时间
可以参考鸟哥的文章：http://www.laruence.com/2012/01/10/2469.html
4.不是全局变量
5.存储信息在服务器上，不发送重要信息到cookie上
6.检查用户user_agent和IP
引用
PHP 使用：if ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT']
|| $_SESSION['user_ip'] != $_SERVER['REMOTE_ADDR']) {
//Something fishy is going on here?
}
7.设置 httpOnly 避免 Session 攻击
参考：http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html
8.Lock down access to the sessions on the file system or use custom session handling
PHP 使用：if ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT']
|| $_SESSION['user_ip'] != $_SERVER['REMOTE_ADDR']) {
//Something fishy is going on here?
}
7.设置 httpOnly 避免 Session 攻击
参考：http://ilia.ws/archives/121-httpOnly-cookie-flag-support-in-PHP-5.2.html
8.Lock down access to the sessions on the file system or use custom session handling
引用
可是自定义session session_set_save_handler()
将session存储在DB, memcached等
9.For sensitive operations consider requiring logged in users to provide their authenication details again
将session存储在DB, memcached等
9.For sensitive operations consider requiring logged in users to provide their authenication details again
