How do I set a more secure cookie to save my login status?

There are two main scenarios:

1. User to hack cookie

2. Malicious user hijacking Cookie impersonating login

How to set a cookie to remember the user's login status and relatively safe?

Reply content:

There are two main scenarios:

1. User to hack cookie

2. Malicious user hijacking Cookie impersonating login

How to set a cookie to remember the user's login status and relatively safe?

Answer the session of friends, I guess the main question is that the user will be able to save the login state, so that the next visit to automatically login. When you mention the session, how to solve the following problems?

• How does the Session timeout count?

• SessionID also needs to exist in a cookie.

Questions about the main question:

1. Encryption problem, AES encryption, strong key will not be cracked, specific add/decrypt see @eechen HTTPS://SEGMENTFAULT.COM/Q/10 ...

2. Prevents the cookie from being injected by XSS.
   HttpOnly , session_id and login states require Httponly,javascript to obtain a cookie with the HttpOnly attribute

PHP's native session_id is not httponly, so laravel in its own implementation of the session of all the logic, and support database, file, Redis and other drivers

Session

Session save is relatively secure on the server side.

The cookie format user_identity|expires_timestamp , for example, encrypts the part that needs to be encode.
Verification, re-decryption verification

Set HttpOnly, prohibit JS access cookie
Use HTTPS to prevent man-in-the-middle attacks

After the user logs in, an authorization token token that generates an encrypted string is saved to the cookie, and the next time the read cookie is opened to verify the token is valid

1. 用户将Cookie进行破解对于这种情况，可以考虑的是加密的复杂度，以及校验逻辑的升级。比如，将访问时间、客户端IP这些东西都作为Cookie 加密的一部分，增加破解难度。

2. 恶意用户劫持Cookie冒充登陆因为Cookie 的加密是结合了客户端的IP 信息的。所以，即使Cookie被用到其他的机器来访问，但是IP 本身也是不匹配的，验证无法通过。同时，我们还可以考虑在服务端，SESSION 存储该Cookie 的信息，用来跟上传信息进行比对，检验cookie信息是否有被篡改过。

There are various ways to do this, just to analyze what we have to think about.

