Question

我正在创建一个小型登录工具。我希望它简单但安全。我想在30分钟不活动后暂停我的会话。我看到了Gumbo对此here的解决方案。但是我不确定在哪里将代码添加到我自己的代码中...有人可以帮助我...... 这是我想要添加到我的代码中的解决方案（通过Gumbo），下面是我自己的login.php页面：

结论/最佳解决方案（from another stackoverflow post）：

最佳解决方案是实现您自己的会话超时。使用表示最后一次活动（即请求）的时间的简单时间戳，并在每次请求时更新它：

<dependencies>
    <!-- ... -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-tomcat</artifactId>
        <scope>provided</scope>
    </dependency>
    <!-- ... -->
</dependencies>

每次请求更新会话数据也会更改会话文件的修改日期，以便垃圾收集器不会过早删除会话。

您还可以使用额外的时间戳来定期重新生成会话ID，以避免对会话固定等会话的攻击：

if (isset($_SESSION['LAST_ACTIVITY']) && (time() - $_SESSION['LAST_ACTIVITY'] > 1800)) {
    // last request was more than 30 minutes ago
    session_unset();     // unset $_SESSION variable for the run-time 
    session_destroy();   // destroy session data in storage
}
$_SESSION['LAST_ACTIVITY'] = time(); // update last activity time stamp

的login.php

if (!isset($_SESSION['CREATED'])) {
    $_SESSION['CREATED'] = time();
} else if (time() - $_SESSION['CREATED'] > 1800) {
    // session started more than 30 minutes ago
    session_regenerate_id(true);    // change session ID for the current session and invalidate old session ID
    $_SESSION['CREATED'] = time();  // update creation time
}

的index.php

<?php
session_start();
header('Content-Type: text/html; charset=utf-8');

require("database.php");
require("phpfunctions.php");
if(isset($_POST["log_out"]) && ($_POST["log_out"] == '1')) {
    //this means we have come from another page after pressing the log out button 
    //so therefore we remove session variables and destroy session
    session_unset(); 
    session_destroy(); 
    //$log_out_message = "You have been logged out";
}

if (isset($_SESSION["username"])) {
    //if the username session variable is already set then they are already logged in so send them to the index page
    //we will perform further checks there on the validity of the session variables
    header("Location: index.php"); 
        exit();
}


    //collect the post data if the login form has been submitted
    if (isset($_POST["username"]) && isset($_POST["password"])){

        $username = preg_replace('#[^A-Za-z0-9]#i', '', $_POST["username"]); // filter everything but numbers and letters
        $password = preg_replace('#[^A-Za-z0-9]#i', '', $_POST["password"]); // filter everything but numbers and letters

        //check if this username and password exist in our database and are therefore valid
        $query = "SELECT * FROM users WHERE username=:username LIMIT 1";

        $statement = $pdoConnection->prepare($query);
        $statement->bindValue(':username', $username, PDO::PARAM_STR);
        $statement->execute();
        $statement->setFetchMode(PDO::FETCH_ASSOC);
        $count = 0;
        while($row = $statement->fetch()){
            //username exists.
            if (password_verify($password, $row["hashedPassword"])) {
                //password is verified
                //store the hashedPassword into a variable.
                $dbHashedValue = $row["hashedPassword"];
                $id = $row["userID"];
                $count++;
            }

        }

        //if count is 1 that means we found matching username in our database and also have verifed the password
        if($count == 1){
            //If our login credentials are matched with the database and therefore valid we store the values into session variables.
            //$_SESSION['incorrectLogin'] = false;
            $_SESSION["userID"] = $id;
            $_SESSION["username"] = $username;
            $_SESSION["password"] = $dbHashedValue;


            //all login information is correct and we have stored it into SESSION variables so 
            //we are ready to allow the user in to our system
            header("Location: index.php");
            //exit the rest of the script

            exit();
        }else if($count == 0){
            //create generic message without giving too much information away to the user in order to be more secure.
            $incorrectLoginDetails = "Invalid Login! Please try again!";

        }

    }


?>

你能帮我添加会话超时代码到我的登录工具吗？

0 个答案: