网站Google OAuth登录后，全应用需验证的会话变量有哪些？

Hey there! Great question—validating session state properly is key to keeping your OAuth implementation secure and user-friendly. Let’s walk through the essential session variables you should check, plus some extra safeguards to harden your setup.

Core Session Variables to Validate Every Time #

These are non-negotiable for confirming a user is properly authenticated:

• $_SESSION['access_token']: You’re already checking this, but don’t just verify it exists—you should also ensure it’s still valid. Google’s access tokens expire after ~1 hour, so pairing this with an expiration timestamp is critical.
• $_SESSION['expires_at']: Store a Unix timestamp of when the access token will expire (you get this from Google’s OAuth response). On every authenticated page load, compare this to time()—if the token is expired, either use a refresh token to get a new one or redirect the user back to login.
• $_SESSION['user_id'] (or $_SESSION['sub']): This is Google’s unique, permanent identifier for the user. It’s far more reliable than an email (which can change) and ensures the session is tied to a specific user. Always validate this exists alongside the access token to prevent empty or hijacked sessions.
• $_SESSION['refresh_token'] (if using offline access): If you requested the offline scope during OAuth setup, Google will send a refresh token. Store this in the session so you can automatically get a new access token when the old one expires, instead of forcing the user to re-login.

Optional (But Highly Recommended) Security Checks #

These add an extra layer of protection against common attacks:

• $_SESSION['session_hash']: Generate a hash using the user’s IP address ($_SERVER['REMOTE_ADDR']) and user agent ($_SERVER['HTTP_USER_AGENT']) when they log in, then store it in the session. On every page load, regenerate the hash and compare it to the stored value. If it doesn’t match, destroy the session—this helps block session hijacking attempts.
• $_SESSION['google_email']: While not strictly for authentication, storing the user’s verified Google email lets you cross-check it with the user_id (via Google’s token info endpoint if needed) and makes user-facing actions (like displaying their name/email) smoother.

Example Validation Script #

Create a reusable auth_check.php file that you include at the top of every page requiring authentication:

<?php
session_start();

// Block access if core auth variables are missing
if (!isset($_SESSION['access_token'], $_SESSION['user_id'], $_SESSION['expires_at'])) {
    session_destroy();
    header("Location: login.php?error=unauthenticated");
    exit;
}

// Check if access token is expired
if (time() > $_SESSION['expires_at']) {
    if (isset($_SESSION['refresh_token'])) {
        // Add your refresh token logic here to get a new access_token and update expires_at
        // If refresh fails, fall back to login
        $refresh_success = false; // Replace with actual refresh logic
        
        if (!$refresh_success) {
            session_destroy();
            header("Location: login.php?error=token_expired");
            exit;
        }
    } else {
        // No refresh token available—force re-login
        session_destroy();
        header("Location: login.php?error=token_expired");
        exit;
    }
}

// Optional: Verify session hash to prevent hijacking
if (isset($_SESSION['session_hash'])) {
    $current_hash = hash('sha256', $_SERVER['REMOTE_ADDR'] . $_SERVER['HTTP_USER_AGENT']);
    if ($_SESSION['session_hash'] !== $current_hash) {
        session_destroy();
        header("Location: login.php?error=session_mismatch");
        exit;
    }
}
?>

Pro Tips for Session Security #

• Regenerate the session ID right after login with session_regenerate_id(true)—this prevents session fixation attacks.
• Avoid storing sensitive data in sessions (like full Google profile data). Stick to only what you need for authentication and user identification.
• Set short session lifetimes in your PHP config (session.cookie_lifetime) to limit the window for hijacking if a session is compromised.

内容的提问来源于stack exchange，提问作者sqlchild