【发布时间】：2013-06-22 16:30:54
【问题描述】：
我有这个安全页面。只是想问一下我的cookie登录是否应该有什么我需要担心的。我不使用 mysql 来保存用户数据，因为只有管理员需要访问该页面。你能告诉我安全登录页面的任何缺陷吗？黑客将如何破解这个安全的主页面？我还需要做些什么来使其更安全。非常感谢。
<?php
$salt = 'a|s534#ihtuQb84z<xIR_ kU;L~?-A?-x|u+Njw##Us(Pi(-hM+YmiQF`Bz[Bl -';
$salt2 = ',/Da|H#s7cWINVi&a4wy9Qc&gVrF*o)u(XoidF?-8w=vkzLRLN4U9 #u88T5818E';
//checks for post details
if (isset($_POST['user'], $_POST['pass'])) {
//santizes the details
$user = preg_replace('/[^A-Za-z0-9]/','', $_POST['user']);
$pass = preg_replace('/[^A-Za-z0-9]/','', $_POST['pass']);
//check if user exists
if (($user === 'admin1' && $pass === 'pass1') ||
($user === 'admin2' && $pass === 'pass2') ||
($user === 'admin3' && $pass === 'pass3')) {
//i can make it that the $user will also be hashed just in case i need to
$cookiemd5 = $user.'-'.sha1(crypt($pass, $salt).md5($_SERVER["REMOTE_ADDR"].$salt2.$_SERVER["HTTP_USER_AGENT"]));
if (intval($_POST['rememberme']) === 1) {
setcookie("temp", $cookiemd5, time()+60*60*24*365, "/", ".domain.com", false, true);
} else {
setcookie("temp", $cookiemd5, false, "/", ".domain.com", false, true);
}
header("Location: /secure.php"); exit();
} else {
header("Location: /secure.php"); exit();
}
} elseif($_GET['do'] === 'logout') {
setcookie("temp", "", time()-2592000, "/", ".domain.com", false, true);
header("Location: /secure.php"); exit();
} elseif (isset($_COOKIE['temp'])) {
$details = explode('-', $_COOKIE['temp']);
if (($details[0] == 'admin1' && $details[1] == sha1(crypt('pass1', $salt).md5($_SERVER["REMOTE_ADDR"].$salt2.$_SERVER["HTTP_USER_AGENT"]))) ||
($details[0] == 'admin2' && $details[1] == sha1(crypt('pass2', $salt).md5($_SERVER["REMOTE_ADDR"].$salt2.$_SERVER["HTTP_USER_AGENT"]))) ||
($details[0] == 'admin3' && $details[1] == sha1(crypt('pass3', $salt).md5($_SERVER["REMOTE_ADDR"].$salt2.$_SERVER["HTTP_USER_AGENT"])))) {
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
//+++++++++++++++++++++ EVERYTHING STARTS HERE AFTER LOGIN ++++++++++++++++++++++++++++++++++++++
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
?>
<?php
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
//+++++++++++++++++++++ EVERYTHING ENDSSS HERE AFTER LOGIN ++++++++++++++++++++++++++++++++++++++
//+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
} else { setcookie("temp", "", time()-2592000, "/", ".domain.com", false, true); header("Location: /secure.php"); }
} else { echo'<form name="login" method="post" action="secure.php"> Username: <input type="text" name="user"><br> Password: <input type="password" name="pass"><br> Remember Me: <input type="checkbox" name="rememberme" value="1"><br> <input type="submit" name="submit" value="Login!"></form>'; } ?>
编辑.... 这个简单的 PHP 会话登录怎么样……这比 cookie 安全得多吗？
<?php
session_start();
if ($_SESSION['logged_in'] == true) {
//++++++++++++++++ secure data start +++++++++++++++++++
//++++++++++++++++ secure data end +++++++++++++++++++
} elseif ($_POST['user'] == 'admin' && $_POST['pass'] == 'H@rDP@s$w0rD98741') {
$_SESSION['logged_in'] = true;
} else {
session_destroy();
}
?>
【问题讨论】：
-
简单明了：为什么不用会话？它们很简单，可以让服务器控制登录有效性。
-
像 AbsoluteƵERØ 所说的那样看起来不错。您可以添加一个睡眠，例如4000 毫秒阻止每次登录检查的暴力攻击
-
@alex 4000ms 听起来有点刺耳，我想你的意思是 400ms
-
@Oleg 取决于登录的目的，我使用 5000 毫秒，因为它只是一次登录，因此不会影响工作流程。
-
使用 $_SESSION，不要编写自己的会话处理程序。这个会话处理程序很垃圾。
标签： php security session cookies login