xss跨站攻击 cookie设置

关于cookie的问题，很多时候遇到的是信息泄露，为什么会有信息泄露，首先要了解什么是xss跨站脚本攻击，xss跨站攻击简单来说就是插入恶意代码，或者劫持用户cookie，从而达到操纵系统的目的。
因此在浏览器上设置cookie的只读属性是安全的。
设置方法如下两步：

     第一步：定义 一过滤器方法：

public class CookieFilter implements Filter {
	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {
		HttpServletRequest req = (HttpServletRequest) request;
	    HttpServletResponse resp = (HttpServletResponse) response;

	    Cookie[] cookies = req.getCookies();

	    if (cookies != null) {
	            Cookie cookie = cookies[0];
	            if (cookie != null) {
	            	/*cookie.setMaxAge(3600);
	            	cookie.setSecure(true);
	            	resp.addCookie(cookie);*/
	            	
	            	//Servlet 2.5不支持在Cookie上直接设置HttpOnly属性
	            	String value = cookie.getValue();
	            	StringBuilder builder = new StringBuilder();
	            	builder.append("JSESSIONID=" + value + "; ");
	            	builder.append("Secure; ");
	            	builder.append("HttpOnly; ");
	            	resp.setHeader("Set-Cookie", builder.toString());
	            }
	    }
	    chain.doFilter(req, resp);
	}

	public void destroy() {
	}

	public void init(FilterConfig arg0) throws ServletException {
	}
}

第二步：web过滤器设置

<filter>
    	<filter-name>cookieFilter</filter-name>
    	<filter-class>com.creditease.component.common.util.CookieFilter</filter-class>
</filter>
<filter-mapping>
    	<filter-name>cookieFilter</filter-name>
    	<url-pattern>/*</url-pattern>
</filter-mapping>

设置效果如下