Java开发 | 安全篇 Cookie设置secure属性
Java开发 | 安全篇 Cookie设置secure属性
What is it and why do I care ?
Session cookies (或者包含JSSESSIONID的cookie)是指用来管理web应用的session会话的cookies.这些cookie中保存特定使用者的session ID标识，而且相同的session ID以及session生命周期内相关的数据也在服务器端保存。在web应用中最常用的session管理方式是通过每次请求的时候将cookies传送到服务器端来进行session识别。
你可以设置附加的secure标识来提示浏览器只能通过Https(加密方式)方式来传输cookie，Http(未加密方式)方式则不可以。这种方式来保证你的session cookie对于攻击者是不可见的，避免中间人攻击（Man-in-the-Middle Attack，简称“MITM攻击”）。这并不是一个完美的session安全管理方案，却是一个重要的步骤。
what should I do about it ？
应对方法很简单。你必须在session cookie添加secure标识（如果有可能的话最好保证请求中的所有cookies都是通过Https方式传输）
如下是示例：未添加secure标识的session cookie-可能会被泄露
Cookie: jsessionid=AS348AF929FK219CKA9FK3B79870H;
添加secure标识：
Cookie: jsessionid=AS348AF929FK219CKA9FK3B79870H; secure;
方式很简洁。你可以甚至可以手工设置这个标识，如果你在Servlet3或者更新的环境中开发，只需要在web.xml简单的配置来实现。你只要在web.xml中添加如下片段：
<session-config>
<cookie-config>
<secure>true</secure>
</cookie-config>
</session-config>
___________________________________________________________________________________________________
Java 开发 | 安全篇 设置Cookie 的HttpOnly属性
Cookie的HttpOnly属性说明
拦截器设置添加
- public class CookieFilter implements Filter {
- public void doFilter(ServletRequest request, ServletResponse response,
- FilterChain chain) throws IOException, ServletException {
- HttpServletRequest req = (HttpServletRequest) request;
- HttpServletResponse resp = (HttpServletResponse) response;
- Cookie[] cookies = req.getCookies();
- if (cookies != null) {
- Cookie cookie = cookies[0];
- if (cookie != null) {
- /*cookie.setMaxAge(3600);
- cookie.setSecure(true);
- resp.addCookie(cookie);*/
- //Servlet 2.5不支持在Cookie上直接设置HttpOnly属性
- String value = cookie.getValue();
- StringBuilder builder = new StringBuilder();
- builder.append("JSESSIONID=" + value + "; ");
- builder.append("Secure; ");
- builder.append("HttpOnly; ");
- Calendar cal = Calendar.getInstance();
- cal.add(Calendar.HOUR, 1);
- Date date = cal.getTime();
- Locale locale = Locale.CHINA;
- SimpleDateFormat sdf =
- new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale);
- builder.append("Expires=" + sdf.format(date));
- resp.setHeader("Set-Cookie", builder.toString());
- }
- }
- chain.doFilter(req, resp);
- }
- public void destroy() {
- }
- public void init(FilterConfig arg0) throws ServletException {
- }
- }
- Manifest-Version: 1.0
- Ant-Version: Apache Ant 1.9.3
- Created-By: 1.6.0_45-b06 (Sun Microsystems Inc.)
- X-Compile-Source-JDK: 1.6
- X-Compile-Target-JDK: 1.6
- Name: javax/servlet/
- Specification-Title: Java API for Servlets
- <span style="color:#ff0000;">Specification-Version: 3.0</span>
- Specification-Vendor: Sun Microsystems, Inc.
- Implementation-Title: javax.servlet
- Implementation-Version: 3.0.FR
- Implementation-Vendor: Apache Software Foundation
Tomcat配置Jsessionid HttpOnly属性
useHttpOnly Should the HttpOnly flag be set on session cookies to prevent client side script from accessing the session ID? Defaults to false.
useHttpOnlyShould the HttpOnly flag be set on session cookies to prevent client side script from accessing the session ID? Defaults to true.
从文档来看tomcat6及5.5useHttpOnly 默认是false、7则是默认true
- <Context useHttpOnly="true"></context>
- <session-config>
- <session-timeout>30</session-timeout>
- <cookie-config>
- <http-only>true</http-only>
- </cookie-config>
- </session-config>
- <Connector port="8080" protocol="HTTP/1.1"
- connectionTimeout="20000"
- redirectPort="8443" secure="true" />
