Detailed explanation of the security solution of YII Framework framework tutorial, yiiframework_PHP tutorial

Detailed explanation of the security solution of the YII Framework framework tutorial, yiiframework

This article describes the security solution of the YII Framework framework. Share it with everyone for your reference, the details are as follows:

The security issue of web applications is very important. In the era when "hackers" are prevalent, your website may be attacked tomorrow. In order to prevent being attacked to some extent, YII provides several solutions to prevent attacks. plan. Of course, the safety discussed here is one-sided, but it is worth a look.

Official solutions include: as follows

1. Prevention of cross-site scripting attacks

Cross-site scripting attack (XSS for short), where web applications collect user data from users. Attackers often inject JavaScript, VBScript, ActiveX, HTML or Flash into vulnerable web applications to confuse visitors and collect visitor information. For example, a poorly designed forum system may display user input without checking. An attacker can inject a piece of malicious JavaScript code into the post content. In this way, when other visitors read this post, these JavaScript codes can be run on the visitor's computer.

One of the most important measures to prevent XSS attacks is to perform content inspection before displaying the content entered by the user. For example, you can escape HTML in content. But in some cases this method is not advisable, because this method disables all HTML tags.

Yii integrates HTMLPurifier and provides developers with a very useful component CHtmlPurifier, which encapsulates the HTMLPurifier class. It can remove all malicious code from the audited content through effective review, security and whitelisting functions, and ensure that the content filtered after filtering meets standards.

CHtmlPurifier component can be used as a widget or filter. When used as a widget, CHtmlPurifier can safely filter the content displayed in the view. Here is a code example:

<&#63;php $this->beginWidget('CHtmlPurifier'); &#63;>
//...这里显示用户输入的内容...
<&#63;php $this->endWidget(); &#63;>

2. Prevention of cross-site request forgery attacks

Cross-site request forgery (referred to as CSRF) attack, that is, when the user's browser visits a malicious website, the attacker causes the user's browser to initiate an attacker-specified request to a trusted website. For example, a malicious website has an image, and the src address of this image points to a bank website: http://bank.example/withdraw?transfer=10000&to=someone. If the user visits this malicious webpage after logging into the bank's website, the user's browser will send an instruction to the bank's website. The content of this instruction may be "transfer 10,000 yuan to the attacker's account." Cross-site attacks take advantage of a specific website that the user trusts, while CSRF attacks, on the contrary, take advantage of the user's specific user identity on a website.

To prevent CSRF attacks, you must remember one thing: GET requests are only allowed to retrieve data and cannot modify any data on the server. The POST request should contain some random values ​​that can be recognized by the server to ensure that the source of the form data and the destination of the running results are the same.

Yii implements a CSRF prevention mechanism to help prevent POST-based attacks. The core of this mechanism is to set a random data in the cookie, and then compare it with the corresponding value in the POST data submitted by the form.

By default, CSRF prevention is disabled. If you want to enable it, edit the CHttpRequest section of the component in the application configuration.

Code example:

return array(
  'components'=>array(
    'request'=>array(
      'enableCsrfValidation'=>true,
    ),
  ),
);

To display a form, use CHtml::form instead of writing HTML code yourself. Because CHtml::form can automatically embed a hidden item in the form. This hidden item stores random data required for verification. This data can be sent to the server for verification when the form is submitted.

3. Prevention of Cookie Attacks

It is very important to protect cookies from attacks. Because session ID is usually stored in Cookie. If the attacker steals a valid session ID, he can use the session information corresponding to this session ID.

Here are some preventive measures:

You can use SSL to create a secure channel and only send authentication cookies over HTTPS connections. In this way, the attacker cannot decrypt the cookie sent.

Set the cookie expiration time, do the same for all cookies and seesion tokens. This reduces the chance of being attacked.

Prevent cross-site code attacks, because it can trigger arbitrary code in the user's browser, and these codes may leak the user's cookies.

Verify the contents of the cookie when the cookie changes.

Yii implements a cookie verification mechanism to prevent cookies from being modified. After enabling, HMAC checking of cookie values ​​can be performed.

Cookie verification is disabled by default. If you want to enable it, edit the CHttpRequest section of the component in the application configuration.

Code example:

return array(
  'components'=>array(
    'request'=>array(
      'enableCookieValidation'=>true,
    ),
  ),
);

Be sure to use cookie data verified by Yii. Use Yii's built-in cookies component for cookie operations. Do not use $_COOKIES.

// 检索一个名为$name的cookie值
$cookie=Yii::app()->request->cookies[$name];
$value=$cookie->value;
......
// 设置一个cookie
$cookie=new CHttpCookie($name,$value);
Yii::app()->request->cookies[$name]=$cookie;

更多关于Yii相关内容感兴趣的读者可查看本站专题：《Yii框架入门及常用技巧总结》、《php优秀开发框架总结》、《smarty模板入门基础教程》、《php日期与时间用法总结》、《php面向对象程序设计入门教程》、《php字符串(string)用法总结》、《php+mysql数据库操作入门教程》及《php常见数据库操作技巧汇总》

希望本文所述对大家基于Yii框架的PHP程序设计有所帮助。

您可能感兴趣的文章:

• PHP YII框架开发小技巧之模型(models)中rules自定义验证规则
• Nginx配置PHP的Yii与CakePHP框架的rewrite规则示例
• 使用Composer安装Yii框架的方法
• Yii使用migrate命令执行sql语句的方法
• YII Framework框架使用YIIC快速创建YII应用之migrate用法实例详解
• YII Framework框架教程之使用YIIC快速创建YII应用详解
• YII Framework框架教程之国际化实现方法
• YII Framework框架教程之缓存用法详解
• YII Framework框架教程之日志用法详解
• YII Framework教程之异常处理详解
• Yii rules常用规则示例

http://www.bkjia.com/PHPjc/1110086.htmlwww.bkjia.comtruehttp://www.bkjia.com/PHPjc/1110086.htmlTechArticleYII Framework框架教程之安全方案详解，yiiframework 本文讲述了YII Framework框架的安全方案。分享给大家供大家参考，具体如下： web应用的安全问...