.NET中的Cookie设置HttpOnly，可以防止JS获取Cookie的值

HttpCookie myHttpCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());

 

        myHttpCookie.Name = "MyHttpCookie";

        //中文编码，防止js获取的Cookie值是乱码，编码之后再解码就不会出现乱码，当然在实际中使用的时候是不需要编码的

        //因为我们就是为了防止js获取Cookie的值，当然在低版本的IE（IE6以下）还是可以取得

        myHttpCookie.Value = HttpUtility.UrlEncode("默认值");

        Response.AppendCookie(myHttpCookie);

 

        Response.Write(string.Format("{0}={1}", myHttpCookie.Name, HttpUtility.UrlDecode(myHttpCookie.Value)));

 

 

        //HttpOnly的Cookie

        HttpCookie myHttpOnlyCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());

 

        myHttpOnlyCookie.HttpOnly = true;

        myHttpOnlyCookie.Name = "MyHttpOnlyCookie";

        myHttpOnlyCookie.Value = "Only值";

        Response.AppendCookie(myHttpOnlyCookie);

 

        Response.Write(string.Format("{0}={1}", myHttpOnlyCookie.Name, myHttpOnlyCookie.Value));

 

 

Js获取Cookie的值，看是否可以获取到，测试

    function getCookie(name){

    var arr = document.cookie.match(new RegExp("(^| )"+name+"=([^;]*)(;|$)"));

    if(arr != null) return decodeURI(arr[2]); return null;

    }

    alert(getCookie("MyHttpCookie"));//默认值

    alert(getCookie("MyHttpOnlyCookie"));//null

//    alert(document.cookie);

 

或直接在地址栏输入：javascript:alert(document.cookie);