PHP user login cookie information security analysis, user login cookie

This article describes the cookie information security of PHP user login with an example. Share it with everyone for your reference, the details are as follows:

Everyone knows that after a user logs in, the user information is generally saved in a cookie, because the cookie is saved on the client side, and the cookie can be freely changed on the client side using the browser. This will cause the risk of forgery of the user's cookie. This may allow someone who forges cookies to log into any user's account.

Here are some common methods to prevent users from logging in cookie information:

1. Cookie information encryption method

The cookie information encryption method uses an encryption method to encrypt user information and then stores the cookie. In this way, even if the forger obtains the cookie, it can only use the cookie within the validity period of the cookie and cannot forge additional cookie information.

Attached here is an encryption function:

<&#63;php
function authcode($string, $operation = 'DECODE', $key = '', $expiry = 0) {
  // 動態(tài)密匙長度，相同的明文會生成不同密文就是依靠動態(tài)密匙
  $ckey_length = 4;
  // 密匙
  $key = md5($key &#63; $key : $GLOBALS['discuz_auth_key']);
  // 密匙a會參與加解密
  $keya = md5(substr($key, 0, 16));
  // 密匙b會用來做數(shù)據(jù)完整性驗證
  $keyb = md5(substr($key, 16, 16));
  // 密匙c用于變化生成的密文
  $keyc = $ckey_length &#63; ($operation == 'DECODE' &#63; substr($string, 0, $ckey_length):
substr(md5(microtime()), -$ckey_length)) : '';
  // 參與運算的密匙
  $cryptkey = $keya.md5($keya.$keyc);
  $key_length = strlen($cryptkey);
  // 明文，前10位用來保存時間戳，解密時驗證數(shù)據(jù)有效性，10到26位用來保存$keyb(密匙b)，
//解密時會通過這個密匙驗證數(shù)據(jù)完整性
  // 如果是解碼的話，會從第$ckey_length位開始，因為密文前$ckey_length位保存 動態(tài)密匙，以保證解密正確
  $string = $operation == 'DECODE' &#63; base64_decode(substr($string, $ckey_length)) :
sprintf('%010d', $expiry &#63; $expiry + time() : 0).substr(md5($string.$keyb), 0, 16).$string;
  $string_length = strlen($string);
  $result = '';
  $box = range(0, 255);
  $rndkey = array();
  // 產(chǎn)生密匙簿
  for($i = 0; $i <= 255; $i++) {
    $rndkey[$i] = ord($cryptkey[$i % $key_length]);
  }
  // 用固定的算法，打亂密匙簿，增加隨機性，好像很復(fù)雜，實際上對并不會增加密文的強度
  for($j = $i = 0; $i < 256; $i++) {
    $j = ($j + $box[$i] + $rndkey[$i]) % 256;
    $tmp = $box[$i];
    $box[$i] = $box[$j];
    $box[$j] = $tmp;
  }
  // 核心加解密部分
  for($a = $j = $i = 0; $i < $string_length; $i++) {
    $a = ($a + 1) % 256;
    $j = ($j + $box[$a]) % 256;
    $tmp = $box[$a];
    $box[$a] = $box[$j];
    $box[$j] = $tmp;
    // 從密匙簿得出密匙進行異或，再轉(zhuǎn)成字符
    $result .= chr(ord($string[$i]) ^ ($box[($box[$a] + $box[$j]) % 256]));
  }
  if($operation == 'DECODE') {
    // 驗證數(shù)據(jù)有效性，請看未加密明文的格式
    if((substr($result, 0, 10) == 0 || substr($result, 0, 10) - time() --> 0) &&
substr($result, 10, 16) == substr(md5(substr($result, 26).$keyb), 0, 16)) {
      return substr($result, 26);
    } else {
      return '';
    }
  } else {
    // 把動態(tài)密匙保存在密文里，這也是為什么同樣的明文，生產(chǎn)不同密文后能解密的原因
    // 因為加密后的密文可能是一些特殊字符，復(fù)制過程可能會丟失，所以用base64編碼
    return $keyc.str_replace('=', '', base64_encode($result));
  }
}
$str = 'abcdef';
$key = 'www.jb51.net';
echo $jm = authcode($str,'ENCODE',$key,0); //加密
echo "
";
echo authcode($jm ,'DECODE',$key,0); //解密
&#63;>

This way when the cookie for user information is set, it cannot be forged:

<&#63;php
$user = array("uid"=-->$uid,"username"=>$username);
$user = base64_encode(serialize($user));
$user = authcode($user,'ENCODE','www.jb51.net',0); //加密
setcookie("user",$user,time()+3600*24);
&#63;>

2. Protect cookies with encryption tokens

$hash = md5($uid.time());//加密令牌值
$hash_expire =time()+3600*24;//加密令牌值為一天有效期
$user = array("uid"=>$uid,"username"=>$username,"hash"=>$hash);
$user = base64_encode(serialize($user));
setcookie("user",$user,$hash_expr);

Then store $hash and $hash_expire in the corresponding fields of hash and hash_expire in the member table. You can also store them in nosql, session

When a user forges a cookie, the hash cannot be forged, and the forged hash is inconsistent with the one in the database

Every time a user logs in, the hash value of this hash_expire will not be updated during the validity period, but will be updated when it expires

Readers who are interested in more PHP related content can check out the special topics of this site: "php curl usage summary", "PHP operation and operator usage summary", "PHP network programming skills summary", "PHP basic syntax introductory tutorial" ", "Summary of PHP office document operation skills (including word, excel, access, ppt)", "Summary of PHP date and time usage", "Introduction to PHP object-oriented programming tutorial", "Summary of PHP string (string) usage" , "Introduction Tutorial on PHP MySQL Database Operation" and "Summary of Common PHP Database Operation Skills"

I hope this article will be helpful to everyone in PHP programming.