cookie

時間 2019-11-12

標籤 cookie 欄目 HTML 简体版

原文原文鏈接

一、基本操做html

Cookie是由服務器端生成，發送給User-Agent（通常是瀏覽器），瀏覽器會將Cookie的key/value保存到某個目錄下的文本文件內，下次請求同一網站時就發送該Cookie給服務器（前提是瀏覽器設置爲啓用cookie）前端

在後臺設置cookie：python

class IndexHanlder(tornado.web.RequestHandler):
    def get(self):
        print(self.cookies) #獲取http請求中攜帶的瀏覽器中的全部cookie
        print(self.get_cookie("k1"))  # 獲取瀏覽器中的cooki
        self.set_cookie("k1","v1")  #爲瀏覽器設置cookie

在前端（瀏覽器上使用JavaScript）：git

document.cookie               #獲取瀏覽器中全部的cookie
document.cookie.split(";")   #獲取瀏覽器中具體某一個cookie，須要先分割，再操做
document.cookie = "k1=999"   #設置cookie

因爲Cookie保存在瀏覽器端，因此在瀏覽器端也能夠使用JavaScript來操做Cookie：web

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<h1>123</h1>
</body>
<script>
/*設置cookie，指定秒數過時*/
function setCookieBySeconds(name,value,expires){
    var current_date = new Date();  //獲取當前時間
    current_date.setSeconds(current_date.getSeconds() + expires);
    document.cookie = name + "= "+ value +";expires=" + current_date.toUTCString();
}
/*設置cookie，指定天數過時*/
function setCookieByDays(name,value,expires){
    var current_date = new Date();  //獲取當前時間
    current_date.setDate(current_date.getDate() + expires);
    document.cookie = name + "= "+ value +";expires=" + current_date.toUTCString();
}
</script>
</html>

二、加密cookie（簽名）瀏覽器

Cookie 很容易被惡意的客戶端僞造。加入你想在 cookie 中保存當前登錄用戶的 id 之類的信息，你須要對 cookie 做簽名以防止僞造。Tornado 經過 set_secure_cookie 和 get_secure_cookie 方法直接支持了這種功能。要使用這些方法，你須要在建立應用時提供一個密鑰，名字爲 cookie_secret。你能夠把它做爲一個關鍵詞參數傳入應用的設置中：安全

def _create_signature_v1(secret, *parts):
    hash = hmac.new(utf8(secret), digestmod=hashlib.sha1)
    for part in parts:
        hash.update(utf8(part))
    return utf8(hash.hexdigest())

# 加密
def _create_signature_v2(secret, s):
    hash = hmac.new(utf8(secret), digestmod=hashlib.sha256)
    hash.update(utf8(s))
    return utf8(hash.hexdigest())

def create_signed_value(secret, name, value, version=None, clock=None,
                        key_version=None):
    if version is None:
        version = DEFAULT_SIGNED_VALUE_VERSION
    if clock is None:
        clock = time.time

    timestamp = utf8(str(int(clock())))
    value = base64.b64encode(utf8(value))
    if version == 1:
        signature = _create_signature_v1(secret, name, value, timestamp)
        value = b"|".join([value, timestamp, signature])
        return value
    elif version == 2:
        # The v2 format consists of a version number and a series of
        # length-prefixed fields "%d:%s", the last of which is a
        # signature, all separated by pipes.  All numbers are in
        # decimal format with no leading zeros.  The signature is an
        # HMAC-SHA256 of the whole string up to that point, including
        # the final pipe.
        #
        # The fields are:
        # - format version (i.e. 2; no length prefix)
        # - key version (integer, default is 0)
        # - timestamp (integer seconds since epoch)
        # - name (not encoded; assumed to be ~alphanumeric)
        # - value (base64-encoded)
        # - signature (hex-encoded; no length prefix)
        def format_field(s):
            return utf8("%d:" % len(s)) + utf8(s)
        to_sign = b"|".join([
            b"2",
            format_field(str(key_version or 0)),
            format_field(timestamp),
            format_field(name),
            format_field(value),
            b''])

        if isinstance(secret, dict):
            assert key_version is not None, 'Key version must be set when sign key dict is used'
            assert version >= 2, 'Version must be at least 2 for key version support'
            secret = secret[key_version]

        signature = _create_signature_v2(secret, to_sign)
        return to_sign + signature
    else:
        raise ValueError("Unsupported version %d" % version)

# 解密
def _decode_signed_value_v1(secret, name, value, max_age_days, clock):
    parts = utf8(value).split(b"|")
    if len(parts) != 3:
        return None
    signature = _create_signature_v1(secret, name, parts[0], parts[1])
    if not _time_independent_equals(parts[2], signature):
        gen_log.warning("Invalid cookie signature %r", value)
        return None
    timestamp = int(parts[1])
    if timestamp < clock() - max_age_days * 86400:
        gen_log.warning("Expired cookie %r", value)
        return None
    if timestamp > clock() + 31 * 86400:
        # _cookie_signature does not hash a delimiter between the
        # parts of the cookie, so an attacker could transfer trailing
        # digits from the payload to the timestamp without altering the
        # signature.  For backwards compatibility, sanity-check timestamp
        # here instead of modifying _cookie_signature.
        gen_log.warning("Cookie timestamp in future; possible tampering %r",
                        value)
        return None
    if parts[1].startswith(b"0"):
        gen_log.warning("Tampered cookie %r", value)
        return None
    try:
        return base64.b64decode(parts[0])
    except Exception:
        return None


def _decode_fields_v2(value):
    def _consume_field(s):
        length, _, rest = s.partition(b':')
        n = int(length)
        field_value = rest[:n]
        # In python 3, indexing bytes returns small integers; we must
        # use a slice to get a byte string as in python 2.
        if rest[n:n + 1] != b'|':
            raise ValueError("malformed v2 signed value field")
        rest = rest[n + 1:]
        return field_value, rest

    rest = value[2:]  # remove version number
    key_version, rest = _consume_field(rest)
    timestamp, rest = _consume_field(rest)
    name_field, rest = _consume_field(rest)
    value_field, passed_sig = _consume_field(rest)
    return int(key_version), timestamp, name_field, value_field, passed_sig


def _decode_signed_value_v2(secret, name, value, max_age_days, clock):
    try:
        key_version, timestamp, name_field, value_field, passed_sig = _decode_fields_v2(value)
    except ValueError:
        return None
    signed_string = value[:-len(passed_sig)]

    if isinstance(secret, dict):
        try:
            secret = secret[key_version]
        except KeyError:
            return None

    expected_sig = _create_signature_v2(secret, signed_string)
    if not _time_independent_equals(passed_sig, expected_sig):
        return None
    if name_field != utf8(name):
        return None
    timestamp = int(timestamp)
    if timestamp < clock() - max_age_days * 86400:
        # The signature has expired.
        return None
    try:
        return base64.b64decode(value_field)
    except Exception:
        return None


def get_signature_key_version(value):
    value = utf8(value)
    version = _get_version(value)
    if version < 2:
        return None
    try:
        key_version, _, _, _, _ = _decode_fields_v2(value)
    except ValueError:
        return None

    return key_version

View Code

5、Session（依賴於cookie）服務器

因爲cookie中須要保存客戶的不少信息，並且若是信息不少的話，服務端與客戶端交互的時候也浪費流量，因此咱們須要用不多的一段字符串來保存不少的信息，這就是咱們所要引進的session。cookie

cookie 和session 的區別：session

一、cookie數據存放在客戶的瀏覽器上，session數據放在服務器上。

二、cookie不是很安全，別人能夠分析存放在本地的COOKIE並進行COOKIE欺騙考慮到安全應當使用session。

三、session會在必定時間內保存在服務器上。當訪問增多，會比較佔用你服務器的性能考慮到減輕服務器性能方面，應當使用COOKIE。

四、單個cookie保存的數據不能超過4K，不少瀏覽器都限制一個站點最多保存20個cookie。

五、因此我的建議：將登錄信息等重要信息存放爲SESSION 其餘信息若是須要保留，能夠放在COOKIE中

　（1）利用session實現用戶驗證

#!/usr/bin/env python
# -*- coding:utf-8 -*-
import tornado.web
import tornado.ioloop
import hashlib
import time
li = {}
class IndexHanlder(tornado.web.RequestHandler):
    def get(self):
        obj = hashlib.md5()
        obj.update(bytes(str(time.time()),encoding="utf-8"))
        random_str = obj.hexdigest()
        li[random_str]={}
        li[random_str]["k1"]=123
        li[random_str]["k2"]=456
        li[random_str]["is_login"]=True
        self.set_cookie("qqqqqq",random_str)
        self.write("成功設置cookie")
    def post(self, *args, **kwargs):
        pass

class ManagerHanlder(tornado.web.RequestHandler):
    def get(self):
        random_str = self.get_cookie("qqqqqq",None)
        current_user_info = li.get(random_str,None)
        if not current_user_info:
            self.redirect("/index")
        else:
            if li[random_str]["is_login"]:
                self.write("歡迎")
            else:
                self.redirect("/index")
        def post(self, *args, **kwargs):
            pass

settings={
    "template_path":"tpl",
     "static_path":"st",
    "cookie_secret":"123"
}

class IndeHanlder(tornado.web.RequestHandler):
    def get(self):
        self.render("1.html")
application = tornado.web.Application([
    (r"/index", IndexHanlder),
    (r"/manager", ManagerHanlder),
],**settings)

if __name__ == "__main__":
    application.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

　（2）利用session驗證用戶精簡版

#!/usr/bin/env/python
# -*- coding:utf-8 -*-
import tornado.web

container = {}
# container = {
#     # "第一我的的隨機字符串":{}，
#     # "第一我的的隨機字符串":{'k1': 111, 'parents': '你'}，
# }

class Session:
    def __init__(self, handler):
        self.handler = handler
        self.random_str = None

    def __genarate_random_str(self):
        import hashlib
        import time
        obj = hashlib.md5()
        obj.update(bytes(str(time.time()), encoding='utf-8'))
        random_str = obj.hexdigest()
        return random_str

    def __setitem__(self, key, value):
        # 在container中加入隨機字符串
        # 定義專屬於本身的數據
        # 在客戶端中寫入隨機字符串
        # 判斷，請求的用戶是否已有隨機字符串
        if not self.random_str:
            random_str = self.handler.get_cookie('__kakaka__')
            if not random_str:
                random_str = self.__genarate_random_str()
                container[random_str] = {}
            else:
                # 客戶端有隨機字符串
                if random_str in container.keys():
                    pass
                else:
                    random_str = self.__genarate_random_str()
                    container[random_str] = {}
            self.random_str = random_str 

        container[self.random_str][key] = value
        self.handler.set_cookie("__kakaka__", self.random_str)

    def __getitem__(self, key):
        # 獲取客戶端的隨機字符串
        # 從container中獲取專屬於個人數據
        #  專屬信息【key】
        random_str =  self.handler.get_cookie("__kakaka__")
        if not random_str:
            return None
        # 客戶端有隨機字符串
        user_info_dict = container.get(random_str,None)
        if not user_info_dict:
            return None
        value = user_info_dict.get(key, None)
        return value
class BaseHandler(tornado.web.RequestHandler):
    def initialize(self):
        self.session = Session(self)
class IndexHandler(BaseHandler):
    def get(self):
        if self.get_argument('u',None) in ['alex','eric']:
            self.session['is_login'] = True
            self.session['name'] =self.get_argument('u',None)
            print(container)
        else:
            self.write('請你先登陸')
class MangerHandler(BaseHandler):
    def get(self):
        val = self.session['is_login']
        if val:
            self.write(self.session['name'])
        else:
            self.write('登陸失敗')
class LoginHandler(BaseHandler):
    def get(self,*args,**kwargs):
        self.render('login.html',status="")
    def post(self, *args, **kwargs):
        user = self.get_argument('user',None)
        pwd = self.get_argument('pwd',None)
        code = self.get_argument('code',None)
        check_code = self.session['CheckCode']
        if code.upper() == check_code.upper():
            self.write('驗證碼正確')
        else:
            self.render('login.html',status ='驗證碼錯誤')
class CheckCodeHandler(BaseHandler):
    def get(self,*args,**kwargs):
        import io
        import check_code
        mstream = io.BytesIO()
        img, code = check_code.create_validate_code()
        img.save(mstream,'GIF')
        self.session['CheckCode']=code
        self.write(mstream.getvalue())
class CsrfHandler(BaseHandler):
    def get(self,*args,**kwargs):
        self.render("csrf.html")
    def post(self, *args, **kwargs):
        self.write("hahahahaah")

settings = {
    'template_path':'views',
    'static_path':'static',
    "xsrf_cookies":True
}
application = tornado.web.Application([
    (r'/index',IndexHandler),
    (r'/manger',MangerHandler),
    (r'/login',LoginHandler),
    (r'/check_code',CheckCodeHandler),
    (r'/csrf',CsrfHandler),
],**settings)

if __name__ == "__main__":
    application.listen(8888)
    tornado.ioloop.IOLoop.instance().start()

相關標籤/搜索

每日一句

每一个你不满意的现在，都有一个你没有努力的曾经。