檢查用戶是否已經登錄，cookie檢查

Question

我遇到了一些問題，我已經發布了一些信息，但我想我會再次問這個問題，因爲我現在有更多的代碼。

，我已經用於教程

function checkLoggedIn($page) 
{ 
    $loginDiv = ''; 
    $action = ''; 
    if (isset($_POST['action'])) 
    { 
     $action = stripslashes ($_POST['action']); 
    } 

    session_start(); 

    // Check if we're already logged in, and check session information against cookies 
    // credentials to protect against session hijacking 
    if (isset ($_COOKIE['project-name']['userID']) && 
     crypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT'], 
      $_COOKIE['project-name']['secondDigest']) == 
     $_COOKIE['project-name']['secondDigest'] && 
     (!isset ($_COOKIE['project-name']['username']) || 
     (isset ($_COOKIE['project-name']['username']) && 
     Users::checkCredentials($_COOKIE['project-name']['username'], 
           $_COOKIE['project-name']['digest'])))) 
    { 
     // Regenerate the ID to prevent session fixation 
     session_regenerate_id(); 

     // Restore the session variables, if they don't exist 
     if (!isset ($_SESSION['project-name']['userID'])) 
     { 
     $_SESSION['project-name']['userID'] = $_COOKIE['project-name']['userID']; 
     } 

     // Only redirect us if we're not already on a secured page and are not 
     // receiving a logout request 
     if (!isSecuredPage ($page) && 
      $action != 'logout') 
     { 
     header ('Location: ./'); 

     exit; 
     } 
    } 
    else 
    { 
     // If we're not already the login page, redirect us to the login page 
     if ($page != Page::LOGIN) 
     { 
     header ('Location: login.php'); 

     exit; 
     } 
    } 

    // If we're not already logged in, check if we're trying to login or logout 
    if ($page == Page::LOGIN && $action != '') 
    { 
     switch ($action) 
     { 
     case 'login': 
     { 
      $userData = Users::checkCredentials (stripslashes ($_POST['login-username']), 
               stripslashes ($_POST['password'])); 
      if ($userData[0] != 0) 
      { 
       $_SESSION['project-name']['userID'] = $userData[0]; 
       $_SESSION['project-name']['ip'] = $_SERVER['REMOTE_ADDR']; 
       $_SESSION['project-name']['userAgent'] = $_SERVER['HTTP_USER_AGENT']; 
       if (isset ($_POST['remember'])) 
       { 
        // We set a cookie if the user wants to remain logged in after the 
        // browser is closed 
        // This will leave the user logged in for 168 hours, or one week 
        setcookie('project-name[userID]', $userData[0], time() + (3600 * 168)); 
        setcookie('project-name[username]', 
        $userData[1], time() + (3600 * 168)); 
        setcookie('project-name[digest]', $userData[2], time() + (3600 * 168)); 
        setcookie('project-name[secondDigest]', 
        DatabaseHelpers::blowfishCrypt($_SERVER['REMOTE_ADDR'] . 
               $_SERVER['HTTP_USER_AGENT'], 10), time() + (3600 * 168)); 
       } 
       else 
       { 
        setcookie('project-name[userID]', $userData[0], false); 
        setcookie('project-name[username]', '', false); 
        setcookie('project-name[digest]', '', false); 
        setcookie('project-name[secondDigest]', 
        DatabaseHelpers::blowfishCrypt($_SERVER['REMOTE_ADDR'] . 
               $_SERVER['HTTP_USER_AGENT'], 10), time() + (3600 * 168)); 
       } 

       header ('Location: ./'); 

       exit; 
      } 
      else 
      { 
       $loginDiv = '<div id="login-box" class="error">The username or password ' . 
          'you entered is incorrect.</div>'; 
      } 
      break; 
     } 
     // Destroy the session if we received a logout or don't know the action received 
     case 'logout': 
     default: 
     { 

      // Destroy all session and cookie variables 
      $_SESSION = array(); 
      setcookie('project-name[userID]', '', time() - (3600 * 168)); 
      setcookie('project-name[username]', '', time() - (3600 * 168)); 
      setcookie('project-name[digest]', '', time() - (3600 * 168)); 
      setcookie('project-name[secondDigest]', '', time() - (3600 * 168)); 

      // Destory the session 
      session_destroy(); 

      $loginDiv = '<div id="login-box" class="info">Thank you. Come again!</div>'; 

      break; 
     } 
     } 
    } 

    return $loginDiv; 
} 

原碼我的代碼：

<?php 

function encrypt($input) 
{ 
$hash = password_hash($input, PASSWORD_DEFAULT); 
return $hash; 
} 

function checkUserCreds($username, $password) 
{ 
    $id = 0; 
    $hash = ''; 

    $db = new PDO('$dbDNS', '$dbuser', '$dbpass'); 
    $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); //Set error mode 
    try 
    { 
     $st = $db->prepare("SELECT id, login, email, pass FROM users WHERE login =:username");  
     $st->bindParam(':username', $username, PDO::PARAM_STR); 
     $success = $st->execute(); 

     if($success) 
     { 
      $userData = $st->fetch(); 
      $hash = $userData['pass']; 
      if (password_verify($password, $hash) == $hash) 
      { 
       $id = $userData['id']; 
      }   
     } 

    } 
    catch (PDOException $e) 
    { 
     $id = 0; 
     $hash = ''; 
    } 
    $db = null; 

    return array ($id, $username, $hash); 
} 

function checkLoggedIn($page) 
{ 
    $loginMess=''; 
    $action=''; 
    if (isset($_POST['action'])) 
    { 
     $action = stripslashes($_POST['action']); 
    } 
    session_start(); 

    //Check if already logged in and check session information against cookies 
    if (isset($_COOKIE['sukd']['id']) && encrypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']) == $_COOKIE['sukd']['hashv2'] && (!isset ($_COOKIE['sukd']['username']) || (isset ($_COOKIE['sukd']['username']) && checkUserCreds($_COOKIE['sukd']['username'], $_COOKIE['sukd']['hash'])))) 
    { 
     echo "isset cookies: ON, GOOD <br>"; 
     // Regenerate the ID to prevent session fixation 
     //session_regenerate_id(); 
    } 
    else 
    { 
     // If we are not on the login page, redirect. 
     if ($page != 'login') 
     { 
      header ('Location login.php'); 
      exit; 
     } 
    } 
    if ($page = 'login' && $action != '') 
    { 
     switch($action) 
     { 
      case 'login': 
      { 
       $userData = checkUserCreds(stripslashes($_POST['username']), stripslashes($_POST['password'])); 

       if ($userData[0] != 0) 
       { 
        $_SESSION['sukd']['id']=$userData[0]; 
        $_SESSION['sukd']['ip']=$_SERVER['REMOTE_ADDR']; 
        $_SESSION['sukd']['userAgent']=$_SERVER['HTTP_USER_AGENT']; 
        if(isset($_POST['remember'])) 
        { 
         //remember for 7 days 
         setcookie('sukd[id]', $userData[0], time() + (3600 * 168)); 
         setcookie('sukd[username]', $userData[1], time() + (3600 * 168)); 
         setcookie('sukd[hash]', $userData[2], time() + (3600 * 168)); 
         setcookie('sukd[hashv2]', encrypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']), time() + (3600 * 168)); 
        } 
        else 
        { 
         setcookie('sukd[id]', $userData[0], false); 
         setcookie('sukd[username]', '', false); 
         setcookie('sukd[hash]', '', false); 
         setcookie('sukd[hashv2]', encrypt($_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']), time() + (3600 * 168)); 
        } 

        header ('Location: ./'); 

        exit; 
       } 
       else 
       { 
        $loginMess = "The username or password you entered is incorrect <br>"; 
       } 
       break;    
      } 
      case 'logout': 
      default: 
      { 
       $_SESSION = array(); 
       setcookie('sukd[id]', '', time() + (3600 * 168)); 
       setcookie('sukd[username]', '', time() + (3600 * 168)); 
       setcookie('sukd[hash]', '', time() + (3600 * 168)); 
       setcookie('sukd[hashv2]', '', time() + (3600 * 168)); 

       session_destroy(); 

       $loginMess = "echo 'Successfully logged out <br>'"; 

       break;   
      }  
     } 
    } 
    return $loginMess; 
} 
?> 

它是由checkLogged(login)例如稱爲和，如果存在這樣的問題輸出的登錄消息。此外，它還使用一個隱藏字段，用於設置案例開關的值，登錄或註銷。目前，它正常登錄，添加cookie等。

但是，問題是，當用戶已經登錄，它應該檢查代碼。

if (isset($_COOKIE['sukd']['id']) && encrypt($_SERVER['REMOTE_ADDR'] etc.. 

我無法真正理解原始代碼，所以我甚至不知道從哪裏開始。 Cookie數組有點奇怪，它看起來是基於兩種不同的版本，這取決於你是設置cookie還是調用cookie。

如果任何人有一個更安全的未經過頂級方法，我很高興有人在這方面進一步啓發我。

原始到我的代碼。

digest = hash 
decondDigest = hashv2 

Answer 1

我不會在函數中調用session_start();。如果你在其他地方使用cookies，無論如何你都會需要它。在任何其他地方之前將它放在第一個文件的開頭。

也許用這個：

if (!isset($_SESSION)) 
    { 
    session_start(); 
    } 

如果任何人有沒有去在上面的方法更安全，我很高興有人來進一步見識一下這個。

爲什麼不切換到$ _SESSIONs？

使用cookies是非常繁瑣的嘗試使其安全，因此用戶無法自己設置某些數據，因爲您現在正在與之戰鬥。相反，我無法在服務器上設置$ _SESSION。

然後，在一個非常簡單的例子：

//your login script 
//if logged in successful: 
$_SESSION['loggedin']['username']=$username; //from DB 
$_SESSION['loggedin']['whatever']=$whatever; 

//Then your login check just checks the session 
if (!isset($_SESSION['loggedin'])) 
    { 
    //redirect to login page or don't server them user stuff 
    } 

那麼你不需要用散列數據打擾你不希望他們看到等 根據您的安全需求，你可以檢查並在會議中設置各種事情。

重要的是，您目前如何使用它，當您檢查cookie中的一些細節時，人們可以設置自己的cookie，這意味着您的代碼可能只檢查用戶設置的cookie並認爲他們已登錄並給予他們訪問的東西，也許是另一個用戶的帳戶。

會話雖然不是百分之百安全的，但沒有任何內容是安全的，因爲存儲在服務器上的Web根目錄是非常安全的，這意味着某人可以擺弄它們，它們已經在服務器中，並設置會議是他們需要做的最後一件事情，造成嚴重破壞。

Answer 2

找到了它不工作的原因。當我應該使用password_verify時，我正在重新使用password_hash。這意味着每次都會給出不同的答案。