给表单加token可以防暴力破解吗？
前提：这里仅对token对防暴力破解的意义进行讨论，不涉及到其他防暴力破解措施，比如验证码等。
看到很多文章都说加token可以防止暴力破解，但并没有说为什么。
据小弟的认识，给表单加token (type=“hidden”)后，这个token不管算法多厉害，但是总归会在前端源码中输出，暴力破解者仍然可以在提交认证前获取它，因此token是不是就失去了防暴力的意义了？
如果可以防止，又是什么逻辑呢？ 麻烦哪位英雄指点一二。谢谢。
回复内容：
前提：这里仅对token对防暴力破解的意义进行讨论，不涉及到其他防暴力破解措施，比如验证码等。
看到很多文章都说加token可以防止暴力破解，但并没有说为什么。
据小弟的认识，给表单加token (type=“hidden”)后，这个token不管算法多厉害，但是总归会在前端源码中输出，暴力破解者仍然可以在提交认证前获取它，因此token是不是就失去了防暴力的意义了？
如果可以防止，又是什么逻辑呢？ 麻烦哪位英雄指点一二。谢谢。
表单token的作用是防止重复提交和CSRF，你的思路没错，破解方只要获取到输出到token值直接提交就可以了。防暴力破解应该理解成防止自动化脚步快速请求以达到破解的目的，所以验证码类防爆破是目前的主流。
没什么用。防账号破解不如考虑一下密码3次错锁定账号15分钟之类的，虽然不去根，但是破解时间极大的延长了。当然如果你一下子锁12小时，一天能尝试6次，一年2200次，估计有生之年没希望了。
没人回答。。5555.
个人觉得，token对CSRF攻击是有效的，因为随机码给攻击者在“伪造请求”时造成了很大的困难。
token一般用于防止重复提交，用于提交后，点击浏览器刷新按钮，或者后退按钮提交，并不能解决暴力破解问题，除非再加上验证码或者速度检测
当然csrf攻击放到也是令牌的一大用处
token抓下来，接着上次的密码再继续请求就可以了 ，可以多弄几台机器，每台机器分一个区间，分布式破解
防止重复提交还行,但是弊端也很大的说,就是 防君子不防小人,给正常人增加难度而已.
大兄弟可以去看看yii2.0如何防止csrf攻击的
Hot AI Tools
Undresser.AI Undress
AI-powered app for creating realistic nude photos
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undress AI Tool
Undress images for free
Clothoff.io
AI clothes remover
Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!
Hot Article
Hot Tools
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
1390
52
Explain JSON Web Tokens (JWT) and their use case in PHP APIs.
Apr 05, 2025 am 12:04 AM
JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,
How do you parse and process HTML/XML in PHP?
Feb 07, 2025 am 11:57 AM
This tutorial demonstrates how to efficiently process XML documents using PHP. XML (eXtensible Markup Language) is a versatile text-based markup language designed for both human readability and machine parsing. It's commonly used for data storage an
PHP Program to Count Vowels in a String
Feb 07, 2025 pm 12:12 PM
A string is a sequence of characters, including letters, numbers, and symbols. This tutorial will learn how to calculate the number of vowels in a given string in PHP using different methods. The vowels in English are a, e, i, o, u, and they can be uppercase or lowercase. What is a vowel? Vowels are alphabetic characters that represent a specific pronunciation. There are five vowels in English, including uppercase and lowercase: a, e, i, o, u Example 1 Input: String = "Tutorialspoint" Output: 6 explain The vowels in the string "Tutorialspoint" are u, o, i, a, o, i. There are 6 yuan in total
Explain late static binding in PHP (static::).
Apr 03, 2025 am 12:04 AM
Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.
Break or return from Java 8 stream forEach?
Feb 07, 2025 pm 12:09 PM
Java 8 introduces the Stream API, providing a powerful and expressive way to process data collections. However, a common question when using Stream is: How to break or return from a forEach operation? Traditional loops allow for early interruption or return, but Stream's forEach method does not directly support this method. This article will explain the reasons and explore alternative methods for implementing premature termination in Stream processing systems. Further reading: Java Stream API improvements Understand Stream forEach The forEach method is a terminal operation that performs one operation on each element in the Stream. Its design intention is
What are PHP magic methods (__construct, __destruct, __call, __get, __set, etc.) and provide use cases?
Apr 03, 2025 am 12:03 AM
What are the magic methods of PHP? PHP's magic methods include: 1.\_\_construct, used to initialize objects; 2.\_\_destruct, used to clean up resources; 3.\_\_call, handle non-existent method calls; 4.\_\_get, implement dynamic attribute access; 5.\_\_set, implement dynamic attribute settings. These methods are automatically called in certain situations, improving code flexibility and efficiency.
The Roles of HTML, CSS, and JavaScript: Core Responsibilities
Apr 08, 2025 pm 07:05 PM
HTML defines the web structure, CSS is responsible for style and layout, and JavaScript gives dynamic interaction. The three perform their duties in web development and jointly build a colorful website.
Explain the match expression (PHP 8 ) and how it differs from switch.
Apr 06, 2025 am 12:03 AM
In PHP8, match expressions are a new control structure that returns different results based on the value of the expression. 1) It is similar to a switch statement, but returns a value instead of an execution statement block. 2) The match expression is strictly compared (===), which improves security. 3) It avoids possible break omissions in switch statements and enhances the simplicity and readability of the code.
