java越权发送邮件_从Java的角度简单修复Cookie越权漏洞

package cookie;import java.io.IOException;import javax.servlet.ServletException;import javax.servlet.http.Cookie;import javax.servlet.http.HttpServlet;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import javax.servlet.http.HttpSession;public class SendCookieServlet extends HttpServlet {

public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

HttpSession session = request.getSession();

session.setAttribute("name", "admin");

String id = session.getId();

//服务器端生成set-cookie

Cookie cookie = new Cookie("JSESSIONID", id);

//设置cookie存活时间为十分钟

cookie.setMaxAge(60*10);

//设置会话cookie允许的路径

//允许整个项目

cookie.setPath("/");

//将cookie中存储的信息发送到客户端---头

response.addCookie(cookie);

}

public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

doGet(request, response);

}

}