對(duì)Session和Cookie的區(qū)分與理解
Jun 21, 2016 am 09:14 AM
cookie|session
對(duì)Session和Cookie的區(qū)分與理解
先說session
對(duì)SESSION的爭論好象一直沒有停止過，不過幺麼能理解SESSION的人應(yīng)該占90以上。但還是講講，別嫌老~
有一些人贊成用SESSION，有一些人不贊成。但這個(gè)問題到底要怎么說。不妨聽聽我的看法,如果有錯(cuò)誤請(qǐng)不要朝丟東西，金條和硬幣除外。
有些人應(yīng)該知道我是做江湖程序的，而江湖程序做看中的就是效率，但這里不談設(shè)計(jì)，而從一些比較實(shí)際的角度看SESSION。
首先要先說SESSION是干什么的，SESSION是可以存儲(chǔ)針對(duì)與某一個(gè)用戶的IE以及通過其當(dāng)前窗口打開的任何窗口具有針對(duì)性的用戶信息存儲(chǔ)機(jī)制。為什么要這樣說。看下邊先研究SESSION是如何啟動(dòng)的，當(dāng)打開IE以后瀏覽網(wǎng)站后會(huì)發(fā)出一個(gè)指令請(qǐng)求SESSIONID以及對(duì)各個(gè)類型數(shù)據(jù)的下載許可，如圖片，聲音以及FLASH。
數(shù)據(jù)實(shí)際傳輸內(nèi)容：IE到服務(wù)器
GET / HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language0: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)
Host: www.jh521.com
Connection: Keep-Alive
服務(wù)器會(huì)返回一個(gè)沒有被使用的SESSIONID讓IE使用，當(dāng)時(shí)IE就對(duì)返回SESSIONID做存儲(chǔ)
并同時(shí)返回相關(guān)頁面的下載數(shù)據(jù)，如下:服務(wù)器到IE
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Sun, 30 Nov 2003 16:41:51 GMT
Content-Length: 21174..Content-Type: text/html
Set-Cookie: ASPSESSIONIDCACBBBRT=IBOMFONAOJFEEBHBPIENJFFC; path=/
Cache-control: private
然后就是頁面HTML代碼此時(shí)這個(gè)IE程序(不是客戶機(jī))的SESSIONID就為IBOMFONAOJFEEBHBPIENJFFC而當(dāng)IE在訪問任何這個(gè)站點(diǎn)的ASP程序的時(shí)候，就會(huì)把IBOMFONAOJFEEBHBPIENJFFC發(fā)送給服務(wù)器，服務(wù)器就會(huì)知道IBOMFONAOJFEEBHBPIENJFFC是表示你而在服務(wù)器上設(shè)置SESSION("name")="name"完全可以看成是SESSION("IBOMFONAOJFEEBHBPIENJFFC")("name")="name"
或者
SESSION(SESSIONID)("name")="name"
這樣，SESSION就區(qū)分開用戶了。
而當(dāng)服務(wù)器反饋這個(gè)ID的時(shí)候會(huì)看這個(gè)ID有沒有被使用。如果有在換一個(gè)
反正不會(huì)讓你重復(fù)，如果想模擬某人的SESSION的ID來進(jìn)行欺騙是可以的。不過要獲取到對(duì)方IE傳輸信號(hào)，并且在保證當(dāng)時(shí)這個(gè)SESSIONID沒有被取消的情況下才可能實(shí)施。
不過要是我有那時(shí)間直接通過POST信號(hào)找他NAME和PASS了。我可不費(fèi)這個(gè)勁,想必一些人明白了了SESSIONID到底是如何工作的,那么就在看看COOKIE,有人說SESSIONID就是COOKIE，按照技術(shù)上來講他們不屬于同類,但是屬于一種工作模式，用戶和服務(wù)器傳輸私有數(shù)據(jù).當(dāng)我設(shè)置COOKIE的時(shí)候，服務(wù)器會(huì)反饋給IE一個(gè)指令。IE通過這個(gè)網(wǎng)絡(luò)指令生成COOKIE并存放,在特定的時(shí)候會(huì)取得這個(gè)這個(gè)信息如在訪問這個(gè)站點(diǎn)并且COOKID有效的時(shí)候。
那么為什么要用COOKIE而不用SESSION呢
看下區(qū)別
有效時(shí)間以及存儲(chǔ)方式 傳輸內(nèi)容
COOKIE 可設(shè)置并在本地保留 明碼信息
SESSION 在IE不關(guān)閉并服務(wù)器不超時(shí) 只有SESSIONID
當(dāng)如果想讓用戶下次登入網(wǎng)站不需要輸入用戶名或者密碼的時(shí)候就只能用COOKIE,
因?yàn)樗梢员Ａ粝喈?dāng)長的時(shí)間(在COOKIE記錄被刪除或者失效日期之前)
而SESSION就不可以，他不會(huì)保留太長時(shí)間，而且IE在關(guān)閉后就自動(dòng)清除了SESSIONID記錄
在下次登入的時(shí)候會(huì)請(qǐng)求新的SESSIONID
而服務(wù)器想通過用戶個(gè)人變量校驗(yàn)用戶的狀態(tài)的時(shí)候，就不能用COOKIE
如果用設(shè)置用戶權(quán)限是USER。而IE訪問的時(shí)候就把USER的明碼傳輸?shù)椒?wù)器。
那么如果我通過一定手段，比如直接修改COOKIE記錄，把USER修改成ADMIN呢~~
就麻煩了。
但存儲(chǔ)用戶名和密碼或者網(wǎng)站的配色方案這樣的信息，用COOKIE是最好的
好，有點(diǎn)累了，在說說這個(gè)東西
Request.ServerVariables("HTTP_REFERER")
我想有一些人通過這個(gè)Request.ServerVariables("HTTP_REFERER")
來進(jìn)行一些關(guān)鍵性限制,特別是對(duì)付遠(yuǎn)程提交以及非法侵入。
那么我就要提醒下服務(wù)器取得的HTTP_REFERER信息完全是IE傳輸給服務(wù)器的，可以模擬
而且難度不大，用不到半個(gè)小時(shí)就可以用VB做出一個(gè)針對(duì)HTTP_REFERER入侵程序。
（可惜我原先那他沒干正經(jīng)事情，做WEB游戲掛機(jī)程序來的)
Hot AI Tools
Undress AI Tool
Undress images for free
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Where are cookies stored?
Dec 20, 2023 pm 03:07 PM
Cookies are usually stored in the cookie folder of the browser. Cookie files in the browser are usually stored in binary or SQLite format. If you open the cookie file directly, you may see some garbled or unreadable content, so it is best to use Use the cookie management interface provided by your browser to view and manage cookies.
Where are the cookies on your computer?
Dec 22, 2023 pm 03:46 PM
Cookies on your computer are stored in specific locations on your browser, depending on the browser and operating system used: 1. Google Chrome, stored in C:\Users\YourUsername\AppData\Local\Google\Chrome\User Data\Default \Cookies etc.
How to solve session failure
Oct 18, 2023 pm 05:19 PM
Session failure is usually caused by the session lifetime expiration or server shutdown. The solutions: 1. Extend the lifetime of the session; 2. Use persistent storage; 3. Use cookies; 4. Update the session asynchronously; 5. Use session management middleware.
Solution to PHP Session cross-domain problem
Oct 12, 2023 pm 03:00 PM
Solution to the cross-domain problem of PHPSession In the development of front-end and back-end separation, cross-domain requests have become the norm. When dealing with cross-domain issues, we usually involve the use and management of sessions. However, due to browser origin policy restrictions, sessions cannot be shared by default across domains. In order to solve this problem, we need to use some techniques and methods to achieve cross-domain sharing of sessions. 1. The most common use of cookies to share sessions across domains
How to solve the problem that document.cookie cannot be obtained
Nov 23, 2023 am 10:02 AM
Solutions for document.cookie not being obtained: 1. Browser privacy settings; 2. Same-origin policy; 3. HTTPOnly Cookie; 4. JavaScript code error; 5. Cookie does not exist or expires; 6. Cross-domain issues; 7. Viewer mode; 8. Server problems; 9. JavaScript execution timing; 10. Check console log, etc.
Where are the mobile cookies?
Dec 22, 2023 pm 03:40 PM
Cookies on the mobile phone are stored in the browser application of the mobile device: 1. On iOS devices, Cookies are stored in Settings -> Safari -> Advanced -> Website Data of the Safari browser; 2. On Android devices, Cookies Stored in Settings -> Site settings -> Cookies of Chrome browser, etc.
How to find cookies in your browser
Jan 19, 2024 am 09:46 AM
In our daily use of computers and the Internet, we are often exposed to cookies. A cookie is a small text file that saves records of our visits to the website, preferences and other information. This information may be used by the website to better serve us. But sometimes, we need to find cookie information to find the content we want. So how do we find cookies in the browser? First, we need to understand where the cookie exists. in browser
Detailed explanation of where browser cookies are stored
Jan 19, 2024 am 09:15 AM
With the popularity of the Internet, we use browsers to surf the Internet have become a way of life. In the daily use of browsers, we often encounter situations where we need to enter account passwords, such as online shopping, social networking, emails, etc. This information needs to be recorded by the browser so that it does not need to be entered again the next time you visit. This is when cookies come in handy. What are cookies? Cookie refers to a small data file sent by the server to the user's browser and stored locally. It contains user behavior of some websites.
