防止服务端产生的cookie被客户端的cookie替换掉

来源：互联网发布：手机最新wpa2破解软件编辑：程序博客网时间：2024/05/22 14:23

今天碰到一个问题

服务端产生的cookie被客户端的cookie替换掉了

解决办法：

把Cookie的HttpOnly这个属性设置为true

下面是两种添加Cookie的方法

Cookie类

/** * 根据部署路径，将cookie保存在根目录。 *  * @param request * @param response * @param name cookie名 * @param valuecookie值 * @param expiry //最大生存时间(秒,0代表删除,-1代表与浏览器会话一致) * @param domain 域 * @param path 路径 * @param secure 是否为安全协议信息 * @param isHttpOnly 是否为HttpOnly(如果未设置，可以被客户端的cookie替换) * @param comment 注释 * @return */public static Cookie addCookie(HttpServletRequest request, HttpServletResponse response, String name, String value, Integer expiry, String domain, String path, Boolean secure, Boolean isHttpOnly, String comment) {Cookie cookie = new Cookie(name, value);if (expiry != null) {cookie.setMaxAge(expiry);}if (StringUtils.isNotBlank(domain)) {cookie.setDomain(domain);}if(secure != null){cookie.setSecure(secure);}if(isHttpOnly != null){cookie.setHttpOnly(isHttpOnly);}if(StringUtils.isNotEmpty(comment)){cookie.setComment(comment);}cookie.setPath(path);response.addCookie(cookie);return cookie;}

response.addHeader()

/** * 具有SameSite属性 * @param request * @param response * @param name * @param value * @param expiry * @param domain * @param path * @param secure * @param isHttpOnly * @param sameSite * @param comment */public static void addCookie(HttpServletRequest request, HttpServletResponse response, String name, String value, Integer expiry, String domain, String path, Boolean secure, Boolean isHttpOnly, String sameSite, String comment) {StringBuilder buffer = new StringBuilder();        buffer.append(name).append("=").append(value).append(";");        if(expiry != null){        /*         * Fri Oct 21 08:36:45 UTC 2016         * Cookie expires 时间格式         */         String expires = DateUtils.formatToString(DateFormat.EEE__MMM__dd__HH_mm_ss__z__yyyy, DateUtils.dateAdd(new Date(), expiry, Calendar.SECOND), Locale.US, TimeZone.getTimeZone("UTC"));        buffer.append("Expires=").append(expires).append(";");    /*      * IE中不支持这个属性     * buffer.append("Max-Age=").append(expiry).append(";");     */        }        if (domain != null) {            buffer.append("domain=").append(domain).append(";");        }        if (path != null) {            buffer.append("path=").append(path).append(";");        }        if (secure != null && secure) {            buffer.append("secure;");        }        if (isHttpOnly != null && isHttpOnly) {            buffer.append("HttpOnly;");        }        if(StringUtils.isNotEmpty(sameSite)){        buffer.append("SameSite=").append(sameSite).append(";");        }        response.addHeader("Set-Cookie", buffer.toString());}

0 0