javascript - 关于使用 crypto-js AES加密 PHP后端解密的问题?求梳理求讲解
看了一下关于加密登陆的相关内容,确实没有证书不是https方式的登陆很不安全,POST的值能全部看到。
找了一些资料关于js加密php解密的资料,但是还是不是非常清楚,
大概思路是通过前台向后台发出请求获得一个密钥,然后前台进行加密,传到后端解密。
(没有证书只是简单的js加密)
问题
1. 在前台向后台请求密钥的时候是不是就有安全隐患,不管是存在cookie还是session
2. 确实很多概念还不清楚就来提问了,但是希望大神能帮忙梳理一下。
http://skysbird.duichenmei.com/?p=306 看到了一下这个代码,思路清晰了一些。
又在网上搜索了到这两段代码。
------javascript
<script> var key_hash = CryptoJS.MD5("Message"); var key = CryptoJS.enc.Utf8.parse(key_hash); var iv = CryptoJS.enc.Utf8.parse('1234567812345678'); var encrypted = CryptoJS.AES.encrypt("Message", key, { iv: iv,mode:CryptoJS.mode.CBC,padding:CryptoJS.pad.ZeroPadding}); document.write("encode:"+encrypted); </script>
php------
$text = "Message"; $key = md5($text); //key的长度必须16,32位,这里直接MD5一个长度为32位的key $iv='1234567812345678'; $crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $text, MCRYPT_MODE_CBC, $iv); $decode = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $crypttext, MCRYPT_MODE_CBC, $iv); echo base64_encode($crypttext); echo "<br/>"; echo $decode; echo "<br/>";
如果是对应的,js的encrypted 传到php 值是和$crypttext 相等,但是mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $crypttext, MCRYPT_MODE_CBC, $iv); 中的$key 是md5的$text。搞不清白了。
求简单细致解说。
回复内容:
看了一下关于加密登陆的相关内容,确实没有证书不是https方式的登陆很不安全,POST的值能全部看到。
找了一些资料关于js加密php解密的资料,但是还是不是非常清楚,
大概思路是通过前台向后台发出请求获得一个密钥,然后前台进行加密,传到后端解密。
(没有证书只是简单的js加密)
问题
1. 在前台向后台请求密钥的时候是不是就有安全隐患,不管是存在cookie还是session
2. 确实很多概念还不清楚就来提问了,但是希望大神能帮忙梳理一下。
http://skysbird.duichenmei.com/?p=306 看到了一下这个代码,思路清晰了一些。
又在网上搜索了到这两段代码。
------javascript
<script> var key_hash = CryptoJS.MD5("Message"); var key = CryptoJS.enc.Utf8.parse(key_hash); var iv = CryptoJS.enc.Utf8.parse('1234567812345678'); var encrypted = CryptoJS.AES.encrypt("Message", key, { iv: iv,mode:CryptoJS.mode.CBC,padding:CryptoJS.pad.ZeroPadding}); document.write("encode:"+encrypted); </script>
php------
$text = "Message"; $key = md5($text); //key的长度必须16,32位,这里直接MD5一个长度为32位的key $iv='1234567812345678'; $crypttext = mcrypt_encrypt(MCRYPT_RIJNDAEL_128, $key, $text, MCRYPT_MODE_CBC, $iv); $decode = mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $crypttext, MCRYPT_MODE_CBC, $iv); echo base64_encode($crypttext); echo "<br/>"; echo $decode; echo "<br/>";
如果是对应的,js的encrypted 传到php 值是和$crypttext 相等,但是mcrypt_decrypt(MCRYPT_RIJNDAEL_128, $key, $crypttext, MCRYPT_MODE_CBC, $iv); 中的$key 是md5的$text。搞不清白了。
求简单细致解说。
- 对。密钥通过明文传播就会有加密隐患。另外有更可怕的例子,已证实有中国运营商直接把用于加密的JS函数给改了。
- 在JS中和PHP中,这里都使用了同一个密钥生成规则:自定义一个
String
,然后用其MD5值做AES密钥。这样一来会避免密钥长度补齐之类的问题。

TomodifydatainaPHPsession,startthesessionwithsession_start(),thenuse$_SESSIONtoset,modify,orremovevariables.1)Startthesession.2)Setormodifysessionvariablesusing$_SESSION.3)Removevariableswithunset().4)Clearallvariableswithsession_unset().5)Destroythe

Arrays can be stored in PHP sessions. 1. Start the session and use session_start(). 2. Create an array and store it in $_SESSION. 3. Retrieve the array through $_SESSION. 4. Optimize session data to improve performance.

PHP session garbage collection is triggered through a probability mechanism to clean up expired session data. 1) Set the trigger probability and session life cycle in the configuration file; 2) You can use cron tasks to optimize high-load applications; 3) You need to balance the garbage collection frequency and performance to avoid data loss.

Tracking user session activities in PHP is implemented through session management. 1) Use session_start() to start the session. 2) Store and access data through the $_SESSION array. 3) Call session_destroy() to end the session. Session tracking is used for user behavior analysis, security monitoring, and performance optimization.

Using databases to store PHP session data can improve performance and scalability. 1) Configure MySQL to store session data: Set up the session processor in php.ini or PHP code. 2) Implement custom session processor: define open, close, read, write and other functions to interact with the database. 3) Optimization and best practices: Use indexing, caching, data compression and distributed storage to improve performance.

PHPsessionstrackuserdataacrossmultiplepagerequestsusingauniqueIDstoredinacookie.Here'showtomanagethemeffectively:1)Startasessionwithsession_start()andstoredatain$_SESSION.2)RegeneratethesessionIDafterloginwithsession_regenerate_id(true)topreventsessi

In PHP, iterating through session data can be achieved through the following steps: 1. Start the session using session_start(). 2. Iterate through foreach loop through all key-value pairs in the $_SESSION array. 3. When processing complex data structures, use is_array() or is_object() functions and use print_r() to output detailed information. 4. When optimizing traversal, paging can be used to avoid processing large amounts of data at one time. This will help you manage and use PHP session data more efficiently in your actual project.

The session realizes user authentication through the server-side state management mechanism. 1) Session creation and generation of unique IDs, 2) IDs are passed through cookies, 3) Server stores and accesses session data through IDs, 4) User authentication and status management are realized, improving application security and user experience.


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

PhpStorm Mac version
The latest (2018.2.1) professional PHP integrated development tool

MinGW - Minimalist GNU for Windows
This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

EditPlus Chinese cracked version
Small size, syntax highlighting, does not support code prompt function

DVWA
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software

ZendStudio 13.5.1 Mac
Powerful PHP integrated development environment
