session.security.html
来自「php的帮助文档,涉及到PHP的案例和基本语法,以及实际应用内容」· HTML 代码 · 共 50 行
HTML
50 行
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <title>Sessions and security</title> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> </head> <body><div style="text-align: center;"> <div class="prev" style="text-align: left; float: left;"><a href="session.customhandler.html">Custom Session Handlers</a></div> <div class="next" style="text-align: right; float: right;"><a href="ref.session.html">Session Functions</a></div> <div class="up"><a href="book.session.html">Sessions</a></div> <div class="home"><a href="index.html">PHP Manual</a></div></div><hr /><div> <h1>Sessions and security</h1> <p class="para"> External links: <a href="http://www.acros.si/papers/session_fixation.pdf" class="link external">» Session fixation</a> </p> <p class="para"> The session module cannot guarantee that the information you store in a session is only viewed by the user who created the session. You need to take additional measures to actively protect the integrity of the session, depending on the value associated with it. </p> <p class="para"> Assess the importance of the data carried by your sessions and deploy additional protections -- this usually comes at a price, reduced convenience for the user. For example, if you want to protect users from simple social engineering tactics, you need to enable <i>session.use_only_cookies</i>. In that case, cookies must be enabled unconditionally on the user side, or sessions will not work. </p> <p class="para"> There are several ways to leak an existing session id to third parties. A leaked session id enables the third party to access all resources which are associated with a specific id. First, URLs carrying session ids. If you link to an external site, the URL including the session id might be stored in the external site's referrer logs. Second, a more active attacker might listen to your network traffic. If it is not encrypted, session ids will flow in plain text over the network. The solution here is to implement SSL on your server and make it mandatory for users. </p></div><hr /><div style="text-align: center;"> <div class="prev" style="text-align: left; float: left;"><a href="session.customhandler.html">Custom Session Handlers</a></div> <div class="next" style="text-align: right; float: right;"><a href="ref.session.html">Session Functions</a></div> <div class="up"><a href="book.session.html">Sessions</a></div> <div class="home"><a href="index.html">PHP Manual</a></div></div></body></html>⌨️ 快捷键说明
复制代码Ctrl + C
搜索代码Ctrl + F
全屏模式F11
增大字号Ctrl + =
减小字号Ctrl + -
显示快捷键?