Question

I m wondering whether for security purposes it would be worth using the session_name() function to rename the default phpsessid to a hashed or encrypted id?

If so, what would be the best way to implement it??

感谢

Answer 1

网上对此做了大量书面说明,先前在StackExchange上读过的问题。本届会议的加密——仅仅制造了另一个易于被劫持的随机编号。

如果您想到这一点,如果您对某届会议进行加密,你要么把会议重新召集到新的会议(在这种情况下,你没有取得任何成就),要么你将使用加密/加密功能。

如果你使用后一种方法,如果有人持有另一用户的加密会议设计书,就会被您的描述加密,并且仍然允许使用。

In short, there is very little point and no real utility in further encrypting your session_id above and beyond the random number it is assigned.

Answer 2

Rename PHPSESSID to another name, say MYNEWNAME, because anybody with little idea about PHP knows that HTTP server doesn’t maintain state and can only keep track of users using PHPSESSID. The PHPSESSID is stored in the clients cookie so I don t consider it as secure. Someone might bruteforce it and perform some action (like a Facebook status post) whenever a session was successfully hijacked. Read more on https://codereview.stackexchange.com/questions/75310/protect-from-people-bruteforcing-the-phpsessid

友情链接