这个方法是否足以保护我的主机(php)?

Question

我想让我的主机高度安全(防止攻击)xss &CSRF…)

• 第一次防御(令牌)

if ( time() >= $_SESSION['token']['expire'] ) {
$length = rand(31,50);
try {
$_SESSION['token']['code'] =  bin2hex(random_bytes($length));
$_SESSION['token']['input'] =  bin2hex(random_bytes($length));
} catch (Exception $e) {
$_SESSION['token']['code'] = substr(base_convert(sha1(uniqid(mt_rand())), 16, 36), 0, $length);
$_SESSION['token']['input'] = substr(base_convert(sha1(uniqid(mt_rand())), 16, 36), 0, $length);
}
$_SESSION['token']['expire'] = time() + 3600;
die(JSON_TIME_OUT);
}

• 第二防御(检查所有查询)

$value = trim(strip_tags(htmlspecialchars(stripslashes($POST['query']))));

• 第三道防线(只允许postREQUEST)

if ($_SERVER['REQUEST_METHOD'] !== 'POST' || sizeof($_GET)) {
http_response_code(405);
exit;
}

• forth defense (for save password in db)

$pass = password_hash("password", PASSWORD_DEFAULT);

我还错过了什么吗?

Answer 1

您错过了SQL注入。

可以使用预处理语句来避免SQL注入。

下面是一个例子:

$conn = mysqli_connect("localhost", "username", "password", "database");
$username = "someone";
$comments = "something like ); SELECT * FROM table;"; #some kind of sql injection
$current_date = date("h:i:s a d-m-Y");
$sql = "INSERT INTO comments (name, comments, date_publish) VALUES (?, ?, ?);";
$stmt = mysqli_stmt_init($conn);
if (!mysqli_stmt_prepare($stmt, $sql)) {
echo "An error occured!";
} else {
mysqli_stmt_bind_param($stmt, "sss", $username, $comment, $current_date);
mysqli_stmt_execute($stmt);
mysqli_stmt_get_result($stmt);
echo "Done!";
}

尽管你已经在你的标题中包含了(php)，我想分享一些安全头:

如果使用Apache，在Apache中添加以下内容:

<IfModule headers_module>
Header always set Expires "-1"
Header always set Cache-Control "no-store, no-cache, must-revalidate, max-age=0"
Header always set Pragma "no-cache"
<FilesMatch ".(gif|jpe?g|png|webp|ico|mp4|mp3)$">
Header always unset Expires
Header always set Cache-Control "must-revalidate, max-age=3600"
Header always unset Pragma
</FilesMatch>
Header always set Content-Security-Policy "default-src 'none'; img-src data: https: 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; style-src 'self'; base-uri 'none'; form-action 'self'; media-src https: 'self'; frame-src 'none'; child-src 'none'; connect-src 'self'"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options nosniff
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" "expr=%{HTTPS} == 'on'"
#Header always set Referrer-Policy "no-referrer"
Header always set Permissions-Policy "geolocation=();midi=();notifications=();push=();sync-xhr=(self);microphone=();camera=();magnetometer=();gyroscope=();speaker=(self);vibrate=();fullscreen=(self);payment=();"
Header always set X-Permitted-Cross-Domain-Policies "none"
</IfModule>

这些是普通的标题:

set-cookie: __Secure-YOURSESSID=abcdefghijklmnopqrstuvwxyz123456789; path=/; secure; HttpOnly; SameSite=Lax
expires: -1
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
content-security-policy: default-src 'none'; img-src data: https: 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; style-src 'self'; base-uri 'none'; form-action 'self'; media-src https: 'self'; frame-src 'none'; child-src 'none'; connect-src 'self'
x-frame-options: DENY
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
permissions-policy: geolocation=();midi=();notifications=();push=();sync-xhr=(self);microphone=();camera=();magnetometer=();gyroscope=();speaker=(self);vibrate=();fullscreen=(self);payment=();
x-permitted-cross-domain-policies: none
content-type: text/html; charset=UTF-8

你可以根据自己的需要修改它们。Content-Security-Policy标头是最重要的一个。它可能会破坏你的网站，但它会有很大的帮助。

使用SSLLabs来测试您的站点的安全性。

这是一个最安全的SSLLabs分数的Apache配置:

SSLCipherSuite TLSv1.3 TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384
SSLOpenSSLConfCmd ECDHParameters secp384r1
#generate DH param using: openssl dhparam -out dhparam.pem 4096
SSLOpenSSLConfCmd DHParameters "/path/to/ssl/dh4096.pem"
SSLHonorCipherOrder On
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLUseStapling On
SSLStaplingCache "shmcb:ssl_stapling(32768)"