What encryption algorithm is best for encrypting cookies?

后端 未结 13 1119
感动是毒
感动是毒 2020-11-30 17:29

Since this question is rather popular, I thought it useful to give it an update.

Let me emphasise the correct answer as given by AviD to

13条回答
  •  孤街浪徒
    2020-11-30 17:33

    If you encrypt the cookie, the server still has to decode it to read it (to check for same key), therefore any encrypted cookie is pointless, because if stolen (and un-edited) it will still lead the hacker right to your account. Its just as unsafe as no encrypted at all.

    I believe the real issue of someone stealing your cookie is the connection between the server and client. Use SSL connection provided by your host.

    As for your cookie, you need to make a long random id per user in the database, (have it change every log on) and just set that as the cookie or session. The cookie that contains the key can be checked via php and if it is equal to an account or table in your database, dump the data on the web page like normal.

提交回复
热议问题