漏洞修复：Cookie Security: HTTPOnly not Set on Application Cookie

描述

The web application does not utilize HTTP only cookies. This is a new security feature introduced by Microsoft in IE 6 SP1 to mitigate the possibility of a successful Cross-Site scripting attack by not allowing cookies with the HTTP only attribute to be accessed via client-side scripts. Recommendations include adopting a development policy that includes the utilization of HTTP only cookies, and performing other actions such as ensuring proper filtration of user-supplied data, utilizing client-side validation of user supplied data, and encoding all user supplied data to prevent inserted scripts being sent to end users in a format that can be executed.

解决方案

nginx
在http下添加 HttpOnly是重点！
add_header Set-Cookie “Path=/; HttpOnly; Secure”;
例如：

http{add_header Set-Cookie "Path=/; HttpOnly; Secure";
}

shiro
在bean的name为sessionIdCookie和rememberMeCookie下增加
cookie.setSecure(true);
例如：

@Bean(name = "sessionIdCookie")
public SimpleCookie getSessionIdCookie() {SimpleCookie cookie = new SimpleCookie("sid");cookie.setHttpOnly(true);//加入这句cookie.setSecure(true);return cookie;
}@Bean(name = "rememberMeCookie")
public SimpleCookie getRememberMeCookie() {SimpleCookie cookie = new SimpleCookie("rememberMe");cookie.setHttpOnly(true);//加入这句cookie.setSecure(true);return simpleCookie;
}

参考

https://vulncat.fortify.com/en/detail?id=desc.config.dotnet.cookie_security_httponly_not_set_on_session_cookie

https://blog.miniasp.com/post/2009/11/26/Using-HttpOnly-flag-to-avoid-XSS-attack

漏洞修复：Cookie Security: HTTPOnly not Set on Application Cookie相关推荐

cookie 设置 httpOnly属性
cookie 设置 httpOnly属性防止js读取cookie. 建立filter拦截器类 CookieHttpOnlyFilter import java.io.IOException; impo ...
漏洞修复：Cookie Security: Overly Permissive SameSite Attribute
描述 The SameSite attribute protects cookies from attacks such as Cross-Site Request Forgery (CSRF). S ...
跨站脚本攻击XSS：为什么cookie中有httpOnly属性
跨站脚本攻击XSS:为什么cookie中有httpOnly属性通过上篇文章的介绍,我们知道了同源策略可以隔离各个站点之间的 DOM 交互.页面数据和网络通信,虽然严格的同源策略会带来更多的安全,但是 ...
Cookie的secure和httpOnly属性的含义以及 Cookie设置HttpOnly，Secure，Expire属性
Cookie的secure和httpOnly属性的含义版权声明:本文为博主原创文章,遵循 CC 4.0 by-sa 版权协议,转载请附上原文出处链接和本声明. 本文链接:https://blog.c ...
常见web安全漏洞修复方案(全面)
第一章 SQL注入漏洞第一节漏洞介绍概述:SQL注入攻击包括通过输入数据从客户端插入或"注入"SQL查询到应用程序.一个成功的SQL注入攻击可以从数据库中获取敏感数据.修改 ...
cookie设置httponly属性防护XSS***
***者利用XSS漏洞获取cookie或者session劫持,如果这里面包含了大量敏感信息(身份信息,管理员信息)等,***这里用获取的COOKIE登陆账号,并进行非法操作. COOKIE设置http ...
CentOS bug修复指令集（阿里云漏洞修复方法）
阿里云服务器经常会提示有漏洞,如 RHSA-2018:0423: kernel security, bug fix, and enhancement update (Moderate),如何修复呢?可 ...
Log4j执行漏洞修复教程
12 月 10 日凌晨,Apache 开源项目 Log4j2 的远程代码执行漏洞细节被公开,漏洞威胁等级为:严重. Log4j2 是一个基于 Java 的日志记录工具.它重写了 Log4j 框架,引入 ...
java+poodle漏洞修复_SSL3.0 POODLE漏洞修复方案
SSL3.0 POODLE漏洞修复方案发布时间:2014-10-15 15:02:27 关于SSLPOODLE漏洞 POODLE = Padding Oracle On Downgraded Leg ...

漏洞修复：Cookie Security: HTTPOnly not Set on Application Cookie

描述

解决方案

参考

漏洞修复：Cookie Security: HTTPOnly not Set on Application Cookie相关推荐

最新文章

热门文章