HttpOnly prevent JavaScript from reading cookies when preventing XSS

If the cookie is set with the HTTPONLY flag, you can avoid javascript from reading cookies when XSS occurs, which is why HttpOnly was introduced.

Implementation method:

Settings in PHP

1. In the php.ini

Session.cookie_httponly = True

2. Global settings in the program:

<?php
Ini_set ("Session.cookie_httponly", 1);

Or
Session_set_cookie_params (0, NULL, NULL, NULL, TRUE);

?>

The 3.Cookie operator function Setcookie function and the Setrawcookie function are also specifically added with the 7th parameter as an option for HttpOnly, with the opening method:

Setcookie ("abc", "Test", NULL, NULL, NULL, NULL, TRUE);

Setrawcookie ("abc", "Test", NULL, NULL, NULL, NULL, TRUE);

4. For previous versions of PHP5.1 and PHP4 versions, the header function is required to work around the following:

Header ("Set-cookie:hidden=value; HttpOnly ");

HttpOnly prevent JavaScript from reading cookies when preventing XSS