Java 设置 httponly cookie

Httponly cookie 是一种 cookie 安全解决方案。

在支持httponly cookie的浏览器（IE6+、FF3.0+）中，如果cookie中设置了“httponly”属性，则JavaScript脚本将无法读取cookie信息，可以有效防止XSS攻击，让网站应用更安全。

但是J2EE4、J2EE5 cookie不提供设置httponly属性的方法，所以如果需要设置httponly属性需要自己处理。

import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletResponse;/*** Cookie Tools*/
public class CookieUtil {/*** Set httponly cookie* @param  Response HTTP response* @param  Cookie cookie object* @param  Ishttponly is httponly*/public static void addCookie(HttpServletResponse response, Cookie cookie, boolean isHttpOnly) {String name = cookie.getName();//Cookie nameString value = cookie.getValue();//Cookie valueint maxAge = cookie.getMaxAge();//Maximum survival time (milliseconds, 0 representative deletion, -1 represents the same as the browser session)String path = cookie.getPath();//pathString domain = cookie.getDomain();//areaboolean isSecure = cookie.getSecure();//Is there a security protocol? StringBuilder buffer = new StringBuilder();buffer.append(name).append("=").append(value).append(";");if (maxAge == 0) {buffer.append("Expires=Thu Jan 01 08:00:00 CST 1970;");} else if (maxAge > 0) {buffer.append("Max-Age=").append(maxAge).append(";");}if (domain != null) {buffer.append("domain=").append(domain).append(";");}if (path != null) {buffer.append("path=").append(path).append(";");}if (isSecure) {buffer.append("secure;");}if (isHttpOnly) {buffer.append("HTTPOnly;");}response.addHeader("Set-Cookie", buffer.toString());}}

值得一提的是，Java Ee 6.0中的cookie已经设置了httponly，所以如果兼容Java EE 6.0兼容的容器（例如Tomcat 7），可以使用cookie.sethttponly设置HTTPONLY：

cookie.setHttpOnly(true);

Java HttpCookie 类的setHttpOnly(Boolean httpOnly) 方法用于指示cookie 是否可以被认为是HTTPOnly。如果设置为 true，则 cookie 不能被 JavaScript 等脚本引擎访问。

句法

public void setHttpOnly(boolean httpOnly)

范围

上述方法只需要一个参数：

httpOnly - 如果 cookie 仅是 HTTP，则表示 true，这意味着它作为 HTTP 请求的一部分可见。

不适用

示例 1

import java.net.HttpCookie;
public class JavaHttpCookieSetHttpOnlyExample1 {  public static void main(String[] args) {  HttpCookie  cookie = new HttpCookie("Student", "1");  // Indicate whether the cookie can be considered as HTTP Only or not.  cookie.setHttpOnly(true);  // Return true if the cookie is considered as HTTPOnly.
System.out.println("Check whether the cookie is HTTPOnly: "+cookie.isHttpOnly());  }  }

输出：

Check whether the cookie is HTTPOnly: true

示例 2

import java.net.HttpCookie;
public class JavaHttpCookieSetHttpOnlyExample2 {  public static void main(String[] args) {  HttpCookie  cookie = new HttpCookie("Student", "1");  // Indicate whether the cookie can be considered as HTTP Only or not.  cookie.setHttpOnly(false);  // Return false if the cookie is not considered as HTTPOnly.  System.out.println("Check whether the cookie is HTTPOnly: "+cookie.isHttpOnly());  }
}

输出：

Check whether the cookie is HTTPOnly: false

示例 3

import java.net.HttpCookie;
public class JavaHttpCookieSetHttpOnlyExample3 {  public static void main(String[] args) {  HttpCookie cookie1 = new HttpCookie("Student1", "1");  HttpCookie cookie2 = new HttpCookie("Student2", "2");  //Indicate whether the cookie can be considered as HTTP Only or not.  cookie1.setHttpOnly(true);  cookie2.setHttpOnly(false);  System.out.println("Check whether the first cookie is HTTPOnly:"+cookie1.isHttpOnly());  System.out.println("Check whether the second cookie is HTTPOnly:"+cookie2.isHttpOnly());  }  }

输出：

Check whether the first cookie is HTTPOnly:true
Check whether the second cookie is HTTPOnly:false

Java 设置 httponly cookie相关推荐

java中的hwid验证,JAVA设置HttpOnly Cookies
HttpOnly Cookies是一个cookie安全行的解决方案. 在支持HttpOnly cookies的浏览器中(IE6+,FF3.0+),如果在Cookie中设置了"HttpOnly ...
JAVA设置HttpOnly Cookies
HttpOnly Cookies是一个cookie安全行的解决方案. 在支持HttpOnly cookies的浏览器中(IE6+,FF3.0+),如果在Cookie中设置了"HttpOnly ...
java设置httponly,java设置httponly
()+3600*24,"","",0); setcookie("TestCookie","abcdef",time()+ ...
java设置httponly_JAVA设置HttpOnly Cookies
HttpOnly Cookies是一个cookie安全行的解决方案. 在支持HttpOnly cookies的浏览器中(IE6+,FF3.0+),如果在Cookie中设置了"HttpOnly ...
php cookie httponly,Cookie的httponly属性设置方法
为了解决XSS(跨站脚本***)的问题,从IE6开始支持cookie的HttpOnly属性,这个属性目前已被大多数浏览器(IE.FF.Chrome.Safari) 所支持.当cookie中的HttpO ...
java设置httponly_Tomcat为Cookie设置HttpOnly属性
B:服务端可以自定义建立Cookie对象及属性传递到客户端: 服务端建立的Cookie如果没有设置HttpOnly属性,则在客户端可以用js读取Cookie中的内容(客户端脚本可以读取Session ...
cookie 设置 httpOnly属性
cookie 设置 httpOnly属性防止js读取cookie. 建立filter拦截器类 CookieHttpOnlyFilter import java.io.IOException; impo ...
Tomcat为Cookie设置HttpOnly属性
A:Tomcat 中维持Java webapp的Http会话是以Cookie形式实现的存储在服务端用户状态信息的: B:服务端可以自定义建立Cookie对象及属性传递到客户端: 服务端建立的Cooki ...
Cookie的secure和httpOnly属性的含义以及 Cookie设置HttpOnly，Secure，Expire属性
Cookie的secure和httpOnly属性的含义版权声明:本文为博主原创文章,遵循 CC 4.0 by-sa 版权协议,转载请附上原文出处链接和本声明. 本文链接:https://blog.c ...

Java 设置 httponly cookie

句法

范围

返回

示例 1

示例 2

示例 3

Java 设置 httponly cookie相关推荐

最新文章

热门文章