Cookie设置HttpOnly

最新推荐文章于 2024-10-19 08:00:00 发布

WuWuII

最新推荐文章于 2024-10-19 08:00:00 发布

阅读量3.3k

点赞数

本文链接：https://blog.csdn.net/a3562323/article/details/105265862

版权

公司处理安全缺陷，解决跨站脚本攻击，
防止跨站脚本漏洞进行Cookie劫持攻击

Filter类

import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.Date;
import java.util.Locale;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class CookieFilter implements Filter {
	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		HttpServletRequest req = (HttpServletRequest) request;
	    HttpServletResponse resp = (HttpServletResponse) response;
 
	    Cookie[] cookies = req.getCookies();
 
	    if (cookies != null) {
	            Cookie cookie = cookies[0];
	            if (cookie != null) {
	            	/*cookie.setMaxAge(3600);
	            	cookie.setSecure(true);
	            	resp.addCookie(cookie);*/
	            	
	            	//Servlet 2.5不支持在Cookie上直接设置HttpOnly属性
	            	String value = cookie.getValue();
	            	StringBuilder builder = new StringBuilder();
	            	builder.append("JSESSIONID=" + value + "; ");
	            	builder.append("Secure; ");
	            	builder.append("HttpOnly; ");
	            	Calendar cal = Calendar.getInstance();
	            	cal.add(Calendar.HOUR, 1);
	            	Date date = cal.getTime();
	            	Locale locale = Locale.CHINA;
	            	SimpleDateFormat sdf = 
	            			new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale);
	            	builder.append("Expires=" + sdf.format(date));
	            	resp.setHeader("Set-Cookie", builder.toString());
	            }
	    }
	    chain.doFilter(req, resp);
	}
 
	public void destroy() {
	}
 
	public void init(FilterConfig arg0) throws ServletException {
	}
}

web.xml加入filter过滤器

    <!-- 设置HttpOnly属性，避免攻击者利用跨站脚本漏洞进行Cookie劫持攻击 -->
    <filter>
    	<filter-name>cookieFilter</filter-name>
    	//该类所在位置
    	<filter-class>com.ddtech.myFilter.CookieFilter</filter-class>
    </filter>
    <filter-mapping>
    	<filter-name>cookieFilter</filter-name>
    	<url-pattern>/*</url-pattern>
    </filter-mapping>