PHP和Vue.js开发安全性最佳实践：防止会话劫持和篡改

// 确保页面使用HTTPS
if ($_SERVER['HTTPS'] != 'on') {
    $redirect_url = "https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
    header("Location: $redirect_url");
    exit;
}

// 生成安全的会话ID
session_start();
session_regenerate_id(true);

// 设置会话过期时间为30分钟
session_start();
$expire_time = 30 * 60;
if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $expire_time)) {
    session_unset();
    session_destroy();
    session_start();
}
$_SESSION['last_activity'] = time();

// 设置会话cookie为HTTP Only
session_start();
session_set_cookie_params(0, "/", "", true, true);

// 设置会话cookie为Secure
session_start();
session_set_cookie_params(0, "/", "", true, true);
ini_set('session.cookie_secure', 1);

// 生成CSRF令牌
function generateCSRFToken() {
    let token = Math.random()
        .toString(36)
        .slice(2);
    localStorage.setItem('csrf_token', token);
}

// 验证CSRF令牌
function validateCSRFToken() {
    let storedToken = localStorage.getItem('csrf_token');
    let receivedToken = document.querySelector('meta[name="csrf-token"]').content;
    if (storedToken !== receivedToken) {
        // CSRF令牌验证失败，处理错误
    }
}