네티즌칼럼

Total article 1116 : 1 page / total 45 page

[1116]

일반 (392)

블록 (81)

코딩 (27)

Subject :

[코딩] 81번과 84번 포트에서 쿠키 인증 에러가 뜨는 원인을 찾았는데요... 이게

(Homepage) \| Point : 66173 \| 2014-10-10 06:41:38 \| Read : 2,678 \| Vote : 28

이게 같은 도메인 서로 다른 포트의 웹서버를 운용할 때 한쪽에서 로그인을 하고 다른 쪽 서버에서 로그인 뒤 리로딩을 하면 이런 메시지가 뜨더라구요. IE에선 그런 증상이 없는데 크롬/파이어팍스/오페라 에선 이런 현상이 있는 모양입니다. 아래 이미지로 캡처한 영문 페이지를 보시면 알겠지만 구글링을 해보아도 마땅한 해결책이 없던데 이거 혹시 아시는 분 계시나요? 방법이 없으면 쿠키 토큰 인증 관련 루틴을 삭제해야할 것 같은데 그건 또 관리자 모드 인증 관련해서도 사용되기 때문에 삭제하기가 좀 그렇네요. 조만간 방법을 찾는대로 제가 다시 포스팅을 하겠습니다. 일단 서비스거부 공격은 아닌 것으로 보여집니다. 
 
<img src='data/clmn1/thumbnail/2/vXL_%B0%B0%C0%BA_%B5%B5%B8%DE%C0%CE_%B4%D9%B8%A5_%C6%F7%C6%AE%B7%CE_%C4%ED%C5%B0_%BA%B8%B3%BB%B1%E2.png.jpg' id=zb_target_resize style="cursor:pointer" onclick="javascript: window.open('img_view.php?img=icon/member_image_box/2/%B0%B0%C0%BA_%B5%B5%B8%DE%C0%CE_%B4%D9%B8%A5_%C6%F7%C6%AE%B7%CE_%C4%ED%C5%B0_%BA%B8%B3%BB%B1%E2.png&width='+(886+10)+'&height='+(1329+55),'imgViewer','width=0,height=0,toolbar=no,scrollbars=no','status=no')" align='' vspace='0' hspace='0' border='1'> 
 
[84번 포트 중간값 찍은 화면] 
<img src='data/clmn1/thumbnail/2/vXL_84%B9%F8_%C6%F7%C6%AE_%BC%AD%B9%F6_%C4%ED%C5%B0_%C5%E4%C5%AB_%C0%CE%C1%F5_%BF%A1%B7%AF.png.jpg' id=zb_target_resize style="cursor:pointer" onclick="javascript: window.open('img_view.php?img=icon/member_image_box/2/84%B9%F8_%C6%F7%C6%AE_%BC%AD%B9%F6_%C4%ED%C5%B0_%C5%E4%C5%AB_%C0%CE%C1%F5_%BF%A1%B7%AF.png&width='+(1920+10)+'&height='+(1050+55),'imgViewer','width=0,height=0,toolbar=no,scrollbars=no','status=no')" align='' vspace='0' hspace='0' border='1'> 
 
[81번 포트 중간값 찍은 화면] 
<img src='data/clmn1/thumbnail/2/vXL_81%B9%F8_%C6%F7%C6%AE_%BC%AD%B9%F6_%C4%ED%C5%B0_%C5%E4%C5%AB_%C0%CE%C1%F5_%BF%A1%B7%AF.png.jpg' id=zb_target_resize style="cursor:pointer" onclick="javascript: window.open('img_view.php?img=icon/member_image_box/2/81%B9%F8_%C6%F7%C6%AE_%BC%AD%B9%F6_%C4%ED%C5%B0_%C5%E4%C5%AB_%C0%CE%C1%F5_%BF%A1%B7%AF.png&width='+(1920+10)+'&height='+(1050+55),'imgViewer','width=0,height=0,toolbar=no,scrollbars=no','status=no')" align='' vspace='0' hspace='0' border='1'> 
 
 
[쿠키 토큰 인증 에러 메시지 출력하는 부분] 
<pre class="brush: php; html_script: true; first-line: 294" title="_head.php">
if(!$member[no]) {
&nbsp;&nbsp;&nbsp;&nbsp;//토큰 초기화
&nbsp;&nbsp;&nbsp;&nbsp;$_token='';
&nbsp;&nbsp;&nbsp;&nbsp;session_register("_token");
&nbsp;&nbsp;&nbsp;&nbsp;setCookie("token","",0,"/","");

&nbsp;&nbsp;&nbsp;&nbsp;$a_login="&lt;a onfocus=blur() href='".$_zb_url."login.php?$href$sort&s_url=$s_url'&gt;";
&nbsp;&nbsp;&nbsp;&nbsp;$a_logout="&lt;Zeroboard ";
&nbsp;&nbsp;&nbsp;&nbsp;$a_member_modify="&lt;Zeroboard ";
&nbsp;&nbsp;&nbsp;&nbsp;$a_member_memo="&lt;Zeroboard ";
} else {

&nbsp;&nbsp;&nbsp;&nbsp;if($member[no]&&$_token!=$_COOKIE['token']) Error("세션 하이재킹은 허용되지 않습니다.&lt;br&gt;세션이 해킹되어 해커가 로그인을 시도하고 있으니 브라우저의 쿠키를 지우고 재접속 바랍니다.&lt;br&gt;그 다음 해커가 계정을 사용하기 전에 즉시 비밀번호를 바꿔야 합니다! 세션토큰: $_token, 브라우저토큰: ".$_COOKIE['token']);
echo "세션토큰: ".$_token." 브라우저토큰: ".$_COOKIE['token'];
&nbsp;&nbsp;&nbsp;&nbsp;$a_login="&lt;Zeroboard ";
&nbsp;&nbsp;&nbsp;&nbsp;$a_logout="&lt;a onfocus=blur() href='".$_zb_url."logout.php?$href$sort&s_url=$s_url'&gt;";
&nbsp;&nbsp;&nbsp;&nbsp;if($member[user_id]!="sprdrg") {
&nbsp;&nbsp;&nbsp;&nbsp;$a_member_modify="&lt;a onfocus=blur() href=# onclick=\"window.open('".$_zb_url."member_modify.php?group_no=$member[group_no]','zbMemberModify','width=560,height=590,toolbars=no,resizable=yes,scrollbars=yes')\"&gt;";
&nbsp;&nbsp;&nbsp;&nbsp;} else $a_member_modify="&lt;Zeroboard ";
&nbsp;&nbsp;&nbsp;&nbsp;$a_member_memo="&lt;a onfocus=blur() href=\"javascript:void(window.open('".$_zb_url."member_memo.php','member_memo','width=450,height=500,status=no,toolbar=no,resizable=yes,scrollbars=yes'))\"&gt;";
}
 </pre> 
 
[로그인 후 토큰 할당하는 부분] 
<pre class="brush: php; html_script: true; first-line: 37" title="login_check.php">
// 회원로그인이 성공하였을 경우 세션을 생성하고 페이지를 이동함
if($member_data[no]) {

&nbsp;&nbsp;&nbsp;&nbsp;//토큰 초기화
&nbsp;&nbsp;&nbsp;&nbsp;$_token2='';
&nbsp;&nbsp;&nbsp;&nbsp;session_register("_token2");
&nbsp;&nbsp;&nbsp;&nbsp;setCookie("token2","",0,"/","");

&nbsp;&nbsp;&nbsp;&nbsp;if($auto_login) {
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;makeZBSessionID($member_data[no]);
&nbsp;&nbsp;&nbsp;&nbsp;}

&nbsp;&nbsp;&nbsp;&nbsp;// 랜덤한 세 숫자를 발생(각1000-9999까지) 후 토큰변수에 대입
&nbsp;&nbsp;&nbsp;&nbsp;$num1 = rand(1000,9999);
&nbsp;&nbsp;&nbsp;&nbsp;$num2 = rand(1000,9999);
&nbsp;&nbsp;&nbsp;&nbsp;$num3 = rand(1000,9999);
&nbsp;&nbsp;&nbsp;&nbsp;$num123 = $num1.$num2.$num3;

&nbsp;&nbsp;&nbsp;&nbsp;//로그인시 토큰 생성
&nbsp;&nbsp;&nbsp;&nbsp;setCookie("token","$num123",0,"/","");
&nbsp;&nbsp;&nbsp;&nbsp;$_token = "$num123";

&nbsp;&nbsp;&nbsp;&nbsp;session_register("_token");

&nbsp;&nbsp;&nbsp;&nbsp;// 4.0x 용 세션 처리
&nbsp;&nbsp;&nbsp;&nbsp;$zb_logged_no = $member_data[no];
&nbsp;&nbsp;&nbsp;&nbsp;$zb_logged_time = time();
&nbsp;&nbsp;&nbsp;&nbsp;$zb_logged_ip = $REMOTE_ADDR;
&nbsp;&nbsp;&nbsp;&nbsp;$zb_last_connect_check = '0';

&nbsp;&nbsp;&nbsp;&nbsp;session_register("zb_logged_no");
&nbsp;&nbsp;&nbsp;&nbsp;session_register("zb_logged_time");
&nbsp;&nbsp;&nbsp;&nbsp;session_register("zb_logged_ip");
&nbsp;&nbsp;&nbsp;&nbsp;session_register("zb_last_connect_check");

&nbsp;&nbsp;&nbsp;&nbsp;// 로그인 후 페이지 이동
&nbsp;&nbsp;&nbsp;&nbsp;$s_url=urldecode($s_url);
&nbsp;&nbsp;&nbsp;&nbsp;if(!$s_url&&$id) $s_url="zboard.php?id=$id";
&nbsp;&nbsp;&nbsp;&nbsp;if($s_url) movepage($s_url);
&nbsp;&nbsp;&nbsp;&nbsp;elseif($id) movepage("zboard.php?id=$id&page=$page&page_num=$page_num&select_arrange=$select_arrange&desc=$des&sn=$sn&ss=$ss&sc=$sc&sm=$sm&keyword=$keyword&category=$category&no=$no");
&nbsp;&nbsp;&nbsp;&nbsp;elseif($group[join_return_url]) movepage($group[join_return_url]);
&nbsp;&nbsp;&nbsp;&nbsp;elseif($referer) movepage($referer);
&nbsp;&nbsp;&nbsp;&nbsp;else echo "&lt;script&gt;history.go(-2);&lt;/script&gt;";

// 회원로그인이 실패하였을 경우 에러 표시
} else {
&nbsp;&nbsp;&nbsp;&nbsp;head();
&nbsp;&nbsp;&nbsp;&nbsp;Error("로그인을 실패하였습니다");
&nbsp;&nbsp;&nbsp;&nbsp;foot();
}
 </pre> 
 
* 관리자님에 의해서 게시물이 이동되었습니다 (2015-06-06 11:14)

3.17.75.227

http://run.blrun.net/
http://www.ntzn.net/
http://www.blrun.net/eight
http://삼성산뜨란채.kr

[HOME]

[bitly]