HttpOnly的设置

描述：

1.会话cookie中缺少HttpOnly属性会导致攻击者可以通过程序(JS脚本、Applet等)获取到用户的cookie信息，造成用户cookie信息泄露，增加攻击者的跨站脚本攻击威胁。

2.HttpOnly是微软对cookie做的扩展，该值指定cookie是否可通过客户端脚本访问。Microsoft Internet Explorer 版本 6 Service Pack 1 和更高版本支持cookie属性HttpOnly。

3.如果在Cookie中没有设置HttpOnly属性为true，可能导致Cookie被窃取。窃取的Cookie可以包含标识站点用户的敏感信息，如ASP.NET会话ID或Forms身份验证票证，攻击者可以重播窃取的Cookie，以便伪装成用户或获取敏感信息，进行跨站脚本攻击等。

4.如果在Cookie中设置HttpOnly属性为true，兼容浏览器接收到HttpOnly cookie，那么客户端通过程序(JS脚本、Applet等)将无法读取到Cookie信息，这将有助于缓解跨站点脚本威胁。

解决方案：

CookieHttpOnlyFilter.java

package org._common.filter;import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.Date;
import java.util.Locale;import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/*** 解决检测到会话cookie中缺少HttpOnly属性的问题* @author kf0101**/
public class CookieHttpOnlyFilter implements Filter {public void destroy() {}public void doFilter(ServletRequest request, ServletResponse response,FilterChain filterChain) throws IOException, ServletException {// TODO Auto-generated method stubHttpServletRequest req = (HttpServletRequest) request; HttpServletResponse resp = (HttpServletResponse) response;Cookie[] cookies = req.getCookies();if(cookies!=null){for(Cookie cookie : cookies){String value = cookie.getValue(); StringBuilder builder = new StringBuilder(); builder.append("JSESSIONID=" + value + "; "); builder.append("Secure; "); builder.append("HttpOnly; "); Calendar cal = Calendar.getInstance(); cal.add(Calendar.HOUR, 1); Date date = cal.getTime(); Locale locale = Locale.CHINA; SimpleDateFormat sdf = new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale); builder.append("Expires=" + sdf.format(date)); resp.setHeader("Set-Cookie", builder.toString());}filterChain.doFilter(request, response);}}public void init(FilterConfig arg0) throws ServletException {// TODO Auto-generated method stub}
}

web.xml：

<filter> <filter-name>cookieHttpOnlyFilter</filter-name> <filter-class>org._common.filter.CookieHttpOnlyFilter</filter-class>  </filter>
<filter-mapping> <filter-name>cookieHttpOnlyFilter</filter-name> <url-pattern>/*</url-pattern>  </filter-mapping>

验证方式：查看浏览器设置（HttpOnly） Set-Cookie: HttpOnly

HttpOnly的设置相关推荐

Cookie没有HttpOnly标志设置 -- Cookie没有安全标志设置
漏洞扫描-- Cookie没有HttpOnly标志设置 java设置session配置: yml文件配置: server:session:cookie:http-only: true 或者proper ...
java设置httponly,java设置httponly
()+3600*24,"","",0); setcookie("TestCookie","abcdef",time()+ ...
php cookie httponly,Cookie的httponly属性设置方法
为了解决XSS(跨站脚本***)的问题,从IE6开始支持cookie的HttpOnly属性,这个属性目前已被大多数浏览器(IE.FF.Chrome.Safari) 所支持.当cookie中的HttpO ...
cookie 设置 httpOnly属性
cookie 设置 httpOnly属性防止js读取cookie. 建立filter拦截器类 CookieHttpOnlyFilter import java.io.IOException; impo ...
cookie设置HttpOnly
1.什么是HttpOnly? 如果cookie中设置了HttpOnly属性,那么通过js脚本将无法读取到cookie信息,这样能有效的防止XSS攻击,窃取cookie内容,这样就增加了cookie的安 ...
php httponly_php如何设置httponly
php设置httponly的方法:首先找到并打开"php.ini"文件:然后设置"session.cookie_httponly"项的值为1或者TRUE:接着通 ...
java httponly设置_cookie 设置 httpOnly属性
cookie 设置 httpOnly属性防止js读取cookie. 建立filter拦截器类 CookieHttpOnlyFilterimport java.io.IOException; impor ...
php httponly_PHP设置Cookie的HTTPONLY属性方法详解
下面小编就为大家带来一篇PHP设置Cookie的HTTPONLY属性方法.小编觉得挺不错的,现在就分享给大家,也给大家做个参考.一起跟随小编过来看看吧 httponly是微软对cookie做的扩展,这 ...
php httponly 测试,php设置httponly的方法
php设置httponly的方法发布时间:2020-08-13 09:55:27 来源:亿速云阅读:92 作者:小新小编给大家分享一下php设置httponly的方法,希望大家阅读完这篇文章后大 ...

HttpOnly的设置

HttpOnly的设置相关推荐

最新文章

热门文章