cookie 设置 httpOnly属性防止js读取cookie.

建立filter拦截器类

CookieHttpOnlyFilterimport java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import javax.servlet.http.HttpSession;

/**

*

*

CookieにHTTPOnly属性を設定インターセプタークラス.

*

* @author hnnc

* @author $Author$

* @version $Id$

*/

public class CookieHttpOnlyFilter implements Filter {

/** {@inheritDoc} **/

public void doFilter(ServletRequest request, ServletResponse response,

FilterChain chain) throws IOException, ServletException {

if (!(request instanceof HttpServletRequest)) {

chain.doFilter(request, response);

return;

}

HttpServletRequest httpReq = (HttpServletRequest) request;

HttpServletResponse httpResp = (HttpServletResponse) response;

Cookie[] cookies = httpReq.getCookies();

if (cookies != null) {

Cookie cookie = cookies[0];

if (cookie != null) {

HttpSession session = httpReq.getSession();

if (session != null) {

String sessionId = session.getId();

// httpの设置

httpResp.addHeader("Set-Cookie", "JSESSIONID=" + sessionId

+ "; Path=/admin; HttpOnly");

// httpsの设置

//                    httpResp.addHeader("Set-Cookie", "JSESSIONID=" + sessionId

//                            + "; Path=/admin;Secure; HttpOnly");

}

}

}

chain.doFilter(httpReq, httpResp);

}

/** {@inheritDoc} **/

public void destroy() {

}

/** {@inheritDoc} **/

public void init(FilterConfig filterConfig) throws ServletException {

}

}

web.xml中配置拦截器

CookieHttpOnly

jp.co.univ.www.admin.filter.CookieHttpOnlyFilter

CookieHttpOnly

/*

参考：