blocks|key|56519|text|首先，我是否正确理解了第二次登录使用与第一次完全相同的机制(通过HTTPS)？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|56520|除了在登录期间创建的会话之外，在不安全页面上的第一次点击是否会创建新的会话？|56521|在第一次登录时，检查cookie是否没有设置Secure标志(这意味着cookie应该只通过安全的(HTTPS)连接发送)。|offset|length|style|CODE|56522|entityMap^0|0|0|M|6|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|N|8|@$F|O|G|P|H|I]]|9|@]|A|$]]|$1|J|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|K|$]]

First of all, do I understand correctly that the second login is using the exact same mechanism as the first (via HTTPS)?

Does the first hit on a unsecured page create a new session, in addition to the one created during login?

Check if, on first login, the cookie is not set with the <code>Secure</code> flag (that means that the cookie should only be sent over a secured (HTTPS) connection).

blocks|key|2545011|text|你的主页上有没有向你的服务器发出后续请求的flash？或者任何Ajax内容加载？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2545012|你检查过从服务器发送的报头了吗？在IE中你可以使用Fiddler，或者在Firefox中使用Live+Headers插件。检查是否设置了任何新的cookie或CAKEPHP+cookie是否具有不同的值。|2545013|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Has your homepage got any flash on it that makes a subsequent request to your server? Or any Ajax loading of content?

Have you checked headers being sent from the server? In IE you can use Fiddler or in Firefox use the Live Headers addon. Check for any new cookies being set or the CAKEPHP cookie having a different value.

blocks|key|56281|text|刚刚遇到这个问题，我评论了以下内容，它工作得很好：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|56282|<br+/>ini_set('session.name',+Configure::read('Session.cookie'));
<br+/>
from+session.php+(/cake/lib/session.php,+line+480~)|code-block|syntax|javascript|56283|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|I|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|J|8|@]|9|@]|A|$E|F]]|$1|G|3|-4|5|6|7|K|8|@]|9|@]|A|$]]]|H|$]]

Just bumped into this problem, I commented the following and it worked fine:

<pre><code>&lt;br /&gt;ini_set('session.name', Configure::read('Session.cookie'));
&lt;br /&gt;
from session.php (/cake/lib/session.php, line 480~)
</code></pre>

blocks|key|57926|text|您可以在配置文件中指定自己的会话处理设置(而不是编辑CakePHP库文件)。在配置文件中，您可以将session.cookie_secure设置为0，它将优先于/cake/lib/session.php中的设置。这将允许会话cookie用于SSL连接和非SSL连接。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|57927|这里有一个关于这个主题的博客文章：http://bakery.cakephp.org/articles/view/how-to-bend-cakephp-s-session-handling-to-your-needs|offset|length|57928|以及食谱中的一些文档：http://book.cakephp.org/view/173/Sessions|57929|entityMap|0|LINK|mutability|MUTABLE|url|http://bakery.cakephp.org/articles/view/how-to-bend-cakephp-s-session-handling-to-your-needs|1|http://book.cakephp.org/view/173/Sessions^0|0|H|2K|0|0|B|15|1|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@$D|T|E|U|1|V]]|A|$]]|$1|F|3|G|5|6|7|W|8|@]|9|@$D|X|E|Y|1|Z]]|A|$]]|$1|H|3|-4|5|6|7|10|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]|P|$5|K|L|M|A|$N|Q]]]]

You can specify your own session handling settings in a configuration file (rather than editing the CakePHP library file.) In the configuration file you can set session.cookie_secure to 0, which will take precedence over the setting in /cake/lib/session.php. This will allow the session cookie to be used for both SSL and non-SSL connections.

Here is a blog entry on the topic:
<a href="http://bakery.cakephp.org/articles/view/how-to-bend-cakephp-s-session-handling-to-your-needs" rel="nofollow noreferrer">http://bakery.cakephp.org/articles/view/how-to-bend-cakephp-s-session-handling-to-your-needs</a>

and some documentation from the Cookbook:
<a href="http://book.cakephp.org/view/173/Sessions" rel="nofollow noreferrer">http://book.cakephp.org/view/173/Sessions</a>

blocks|key|57252|text|虽然被接受的答案满足了OP的愿望，即“一旦登录，就将人们从SSL上移走”-但它是非常不安全的，因为它将用户会话暴露在劫持之下(参见Firesheep了解简单的漏洞利用)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|57253|在CakePHP的默认行为(要求在用户通过SSL进行身份验证后为所有页面提供SSL)和接受的答案(提供所有未加密的经过身份验证的页面并公开经过身份验证的cookie)之间更好的折衷是，当且仅当页面需要身份验证时，才通过SSL提供加密的页面。|57254|要实现这一点，一种简单的方法是维护两个会话cookies一个安全地提供并保存身份验证信息，另一个不安全地提供。支持这种双会话方法的一个简单实现将使用session_handler覆盖session.name，如下所示：|57255|++++if+(env('HTTPS'))+{
++++++++ini_set('session.name',+Configure::read('Session.cookie').'-SECURE');
++++}else{
++++++++ini_set('session.name',+Configure::read('Session.cookie'));
++++}+|code-block|syntax|javascript|57256|这种方法需要记住的一点是，要从非SSL页面直接链接到需要身份验证的页面，将需要使用https显式链接-因为您将需要发送包含身份验证信息的会话cookie，而浏览器只有在链接被加密时才会这样做。|57257|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|Q|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|R|8|@]|9|@]|A|$I|J]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

While the accepted answer meets the OP's desire to "move people off of SSL once logged in" - it's horribly insecure in that it exposes the user session to hijacking (See Firesheep for an easy exploit).

A better compromise between the default behavior of CakePHP (which requires all pages to be served SSL after a user authenticates over SSL) and the accepted answer (which serves all authenticated pages unencrypted and exposes the authenticated cookie) is to serve pages encrypted over SSL if and only if they require authentication. 

An easy way to accomplish this is to maintain two session cookies - one that is served secure and holds the authentication information and another which is served insecure. A simple implementation to support such a dual-session approach will use a session_handler to override the session.name like so:

<pre><code> if (env('HTTPS')) {
 ini_set('session.name', Configure::read('Session.cookie').'-SECURE');
 }else{
 ini_set('session.name', Configure::read('Session.cookie'));
 } 
</code></pre>

One item to keep in mind with this approach is that to link from a non-SSL page directly to a page that requires authentication will require you to explicitly link using https - since you'll need to send the session cookie containing the authentication information and the browser will only do so if the link is encrypted.

blocks|key|2545149|text|您可以在SSL的文档CakePHP中阅读更多信息。当您的应用程序使用http://book.cakephp.org/2.0/en/development/sessions.html协议时，它的默认设置是将session.cookie_secure设置为true。如果您的应用程序同时使用SSL和非SSL协议，那么您可能会遇到丢失会话的问题。如果您需要访问SSL和非SSL域上的会话，则需要禁用此功能：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|2545150|打开文件Config/core.php并添加如下所示|2545151|Configure::write('Session',+array(
++++'defaults'+=>+'php',
++++'ini'+=>+array(
++++++++'session.cookie_secure'+=>+false
++++)
));|code-block|syntax|javascript|2545152|现在您可以切换不会丢失会话的http和https+:)|2545153|entityMap|0|LINK|mutability|MUTABLE|url|http://book.cakephp.org/2.0/en/development/sessions.html^0|Y|1K|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]]|C|$]]|$1|D|3|E|5|6|7|Y|8|@]|9|@]|C|$]]|$1|F|3|G|5|H|7|Z|8|@]|9|@]|C|$I|J]]|$1|K|3|L|5|6|7|10|8|@]|9|@]|C|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|C|$]]]|N|$O|$5|P|Q|R|C|$S|T]]]]

You can read more in documentation CakePHP at 
<a href="http://book.cakephp.org/2.0/en/development/sessions.html" rel="nofollow">http://book.cakephp.org/2.0/en/development/sessions.html</a>
CakePHP’s defaults to setting session.cookie_secure to true, when your application is on an SSL protocol. If your application serves from both SSL and non-SSL protocols, then you might have problems with sessions being lost. If you need access to the session on both SSL and non-SSL domains you will want to disable this:

You open file Config/core.php and add as bellow

<pre><code>Configure::write('Session', array(
 'defaults' =&gt; 'php',
 'ini' =&gt; array(
 'session.cookie_secure' =&gt; false
 )
));
</code></pre>

Now you can switch http and https that not lose session :)

I have a login screen that I force to be ssl, so like this:
<a href="https://www.foobar.com/login" rel="noreferrer">https://www.foobar.com/login</a>
then after they login, they get moved to the homepage:
<a href="https://www.foobar.com/dashbaord" rel="noreferrer">https://www.foobar.com/dashbaord</a>

However, I want to move people off of SSL once logged in (to save CPU), so just after checking that they are in fact logged in on <a href="https://www.foobar.com/dashbaord" rel="noreferrer">https://www.foobar.com/dashbaord</a> I move them to 
<a href="http://www.foobar.com/dashbaord" rel="noreferrer">http://www.foobar.com/dashbaord</a>

Well this always seems to wipe out the session variables, because when the page runs again, it confirms they are logged in (as all pages do) and session appears not to exist, so it moves them to the login screen.

Oddness/findings:

<ol>
<li>List item</li>
<li>The second login always works, and happily gets me to <a href="http://www.foobar.com/dashbaord" rel="noreferrer">http://www.foobar.com/dashbaord</a></li>
<li>It successfully creates a cookie the first login</li>
<li>If I login twice, then logout, and login again, I don't need two logins (I seem to have traced this to the fact that the cookie exists). If I delete the cookie, I'm back to two logins.</li>
<li>After the second login, I can move from non-ssl from ssl and the session persists.</li>
<li>On the first login, the move to the non-ssl site wipes out the session entirely, manually moving back to the ssl site still forces me to login again.</li>
<li>The second login using the exact same mechanism as the first, over ssl</li>
</ol>

What I tried:

<ol>
<li>Playing with Cake's settings for security.level and session.checkagent - nothing</li>
<li>Having cake store the sessions in db (as opposed to file system) - nothing</li>
<li>Testing in FF, IE, Chrome on an XP machine.</li>
</ol>

So I feel like this is something related to the cookie being created but not being read. 

Environment:
1. Debian
2. Apache 2
3. Mysql 4
4. PHP 5
5. CakePHP
6. Sessions are being saved PHP default, as files

Session not saving when moving from ssl to non-ssl

我有一个登录屏幕，我强制将其设置为ssl，所以如下所示：然后他们登录后，他们被移动到主页：但是，我希望在用户登录后将其从SSL上移出(以节省CPU)，因此在检查他们实际上已登录到之后，我会将其移至。这似乎总是会清除会话变量，因为当页面再次运行时，它会确认它们已登录(就像所有页面一样)，并且会话似乎不存在，因此它会将它们...

问从ssl移动到非ssl时不保存会话
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问从ssl移动到非ssl时不保存会话EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问从ssl移动到非ssl时不保存会话
EN