Cookie中的HttpOnly
1.什么是HttpOnly?
如果您在cookie中设置了HttpOnly属性，那么通过js脚本将无法读取到cookie信息，这样能有效的防止XSS攻击，具体一点的介绍请google进行搜索
2.javaEE的API是否支持?
目前sun公司还没有公布相关的API，但PHP、C#均有实现。搞javaEE的兄弟们比较郁闷了，别急下文有变通实现
3.HttpOnly的设置样例
javaEE
|
1
2
|
response.setHeader("Set-Cookie", "cookiename=value;Path=/;Domain=domainvalue;Max-Age=seconds;HTTPOnly"); |
具体参数的含义再次不做阐述，设置完毕后通过js脚本是读不到该cookie的，但使用如下方式可以读取
|
1
|
Cookie cookies[]=request.getCookies(); |
C#
|
1
2
3
|
HttpCookie myCookie = new HttpCookie("myCookie"); myCookie.HttpOnly = true; Response.AppendCookie(myCookie); |
VB.NET
|
1
2
3
|
Dim myCookie As HttpCookie = new HttpCookie("myCookie") myCookie.HttpOnly = True Response.AppendCookie(myCookie) |
但是在 .NET 1.1 ,中您需要手动添加
|
1
|
Response.Cookies[cookie].Path += ";HTTPOnly"; |
PHP4
|
1
|
header("Set-Cookie: hidden=value; httpOnly"); |
PHP5
|
1
|
setcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); |
最后一个参数为HttpOnly属性
----------------------------------------------------------------------------------
webBrowser
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
namespace WindowsFormsApplication1
{
/// <summary>
/// WinInet.dll wrapper
/// </summary>
internal static class CookieReader
{
private const int INTERNET_COOKIE_HTTPONLY = 0x00002000;
[DllImport("wininet.dll", SetLastError = true)]
private static extern bool InternetGetCookieEx(
string url,
string cookieName,
StringBuilder cookieData,
ref int size,
int flags,
IntPtr pReserved);
public static string GetCookie(string url)
{
int size = 512;
StringBuilder sb = new StringBuilder(size);
if (!InternetGetCookieEx(url, null, sb, ref size, INTERNET_COOKIE_HTTPONLY, IntPtr.Zero))
{
if (size < 0)
{
return null;
}
sb = new StringBuilder(size);
if (!InternetGetCookieEx(url, null, sb, ref size, INTERNET_COOKIE_HTTPONLY, IntPtr.Zero))
{
return null;
}
}
return sb.ToString();
}
}
}
********************************************************************************************************************************************************
using System;
using System.ComponentModel;
using System.Net;
using System.Runtime.InteropServices;
using System.Security;
using System.Security.Permissions;
using System.Text;
namespace CookieHandler
{
internal sealed class INativeMethods
{
#region enums
public enum ErrorFlags
{
ERROR_INSUFFICIENT_BUFFER = 122,
ERROR_INVALID_PARAMETER = 87,
ERROR_NO_MORE_ITEMS = 259
}
public enum InternetFlags
{
INTERNET_COOKIE_HTTPONLY = 8192, //Requires IE 8 or higher
INTERNET_COOKIE_THIRD_PARTY = 131072,
INTERNET_FLAG_RESTRICTED_ZONE = 16
}
#endregion
#region DLL Imports
[SuppressUnmanagedCodeSecurity, SecurityCritical, DllImport("wininet.dll", EntryPoint = "InternetGetCookieExW", CharSet = CharSet.Unicode, SetLastError = true, ExactSpelling = true)]
internal static extern bool InternetGetCookieEx([In] string Url, [In] string cookieName, [Out] StringBuilder cookieData, [In, Out] ref uint pchCookieData, uint flags, IntPtr reserved);
#endregion
}
}
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Net;
using System.Runtime.InteropServices;
using System.Security;
using System.Security.Permissions;
using System.Text;
namespace CookieHandler
{
/// <SUMMARY></SUMMARY>
/// 取得WebBrowser的完整Cookie。
/// 因为默认的webBrowser1.Document.Cookie取不到HttpOnly的Cookie
/// IE7不兼容，IE8可以，其它未知
///
public class FullWebBrowserCookie
{
public static Dictionary<string, string> GetCookieList(Uri uri, bool throwIfNoCookie)
{
Dictionary<string, string> dict = new Dictionary<string, string>();
string cookie = GetCookieInternal(uri, throwIfNoCookie);
Console.WriteLine("FullWebBrowserCookie - 所有cookie:" + cookie);
string[] arrCookie = cookie.Split(';');
foreach (var item in arrCookie)
{
string[] arr = item.Split('=');
string key = arr[0].Trim();
string val = "";
if (arr.Length >= 2)
{
val = arr[1].Trim();
}
if (!dict.ContainsKey(key))
{
dict.Add(key, val);
}
}
Console.WriteLine("FullWebBrowserCookie - cookie已载入dict，共" + dict.Count.ToString() + "项");
return dict;
}
public static string GetCookieValue(string key, Uri uri, bool throwIfNoCookie)
{
Console.WriteLine("GetCookieValue");
Dictionary<string, string> dict = GetCookieList(uri, throwIfNoCookie);
if (dict.ContainsKey(key))
{
return dict[key];
}
return "";
}
[SecurityCritical]
public static string GetCookieInternal(Uri uri, bool throwIfNoCookie)
{
Console.WriteLine("GetCookieInternal");
uint pchCookieData = 0;
string url = UriToString(uri);
uint flag = (uint)INativeMethods.InternetFlags.INTERNET_COOKIE_HTTPONLY;
//Gets the size of the string builder
if (INativeMethods.InternetGetCookieEx(url, null, null, ref pchCookieData, flag, IntPtr.Zero))
{
pchCookieData++;
StringBuilder cookieData = new StringBuilder((int)pchCookieData);
//Read the cookie
if (INativeMethods.InternetGetCookieEx(url, null, cookieData, ref pchCookieData, flag, IntPtr.Zero))
{
DemandWebPermission(uri);
return cookieData.ToString();
}
}
int lastErrorCode = Marshal.GetLastWin32Error();
if (throwIfNoCookie || (lastErrorCode != (int)INativeMethods.ErrorFlags.ERROR_NO_MORE_ITEMS))
{
throw new Win32Exception(lastErrorCode);
}
return null;
}
private static void DemandWebPermission(Uri uri)
{
string uriString = UriToString(uri);
if (uri.IsFile)
{
string localPath = uri.LocalPath;
new FileIOPermission(FileIOPermissionAccess.Read, localPath).Demand();
}
else
{
new WebPermission(NetworkAccess.Connect, uriString).Demand();
}
}
private static string UriToString(Uri uri)
{
if (uri == null)
{
throw new ArgumentNullException("uri");
}
UriComponents components = (uri.IsAbsoluteUri ? UriComponents.AbsoluteUri : UriComponents.SerializationInfoString);
return new StringBuilder(uri.GetComponents(components, UriFormat.SafeUnescaped), 2083).ToString();
}
}
}
