ASP平台的Cookie会话攻击及防范措施  

Cookie Session Attack and Preventive Measures Based on ASP Platform

作　　者：王凤利[1] 刘兴纲[2] 许唯玮 

机构地区：[1]河北北方学院信息科学与工程学院 [2]张家口职业技术学院 [3]张家口市电化教育馆

出　　处：《河北北方学院学报（自然科学版）》2011年第3期52-55,共4页Journal of Hebei North University:Natural Science Edition

摘　　要：Cookie是Web服务器保存在用户浏览器上的文本信息.它相当于网站发给某用户进入该网站的身份的标识.在许可的时间中,用户可以凭着这个身份标识在该网站中行使自已的合法权限.由于Cookie信息是被保存在客户端的,这就给恶意攻击者提供了窍取通行证的可能.一旦Cookie信息被窍取,攻击者就可以伪装成该用户,为其他类型的Web攻击提供便利.借助ASP平台程序分析了攻击者通常获取Cookie信息的方法并给出了相应的防范措施.对实际网站的开发及网站的运行有非常重要的指导意义.Cookie is the web server preservation on the user browser＇ s text information.It is equal to the identification symbol issued by website to some users to enter this website.In permitted time,the user may exercise the legal authority by reason of this identification.Because the Cookie information is preserved in the client side,it gives the malicious aggressor possibility to steal the permission.Once the Cookie information is taken,the aggressor may camouflage as the user to provide convenience for other type＇ s web attack.This paper analyzes the usual methods of cookie information with the aid of the ASP platform and provides the corresponding measures.It has very important meaning in guiding the actual website＇s development and the website movement.

关 键 词：ASP平台 Cookie会话攻击 网站入侵 网站安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]