Recent machine room let rectification of the loopholes set cookie HttpOnly x-frame-options header is not set

Source: Internet
Author: User
Tags set cookie setcookie wordpress blog

Https://www.jb51.net/article/105018.htm

Settings in PHP

PHP5.2 above has supported the setting of the HttpOnly parameter, also supports the setting of global HttpOnly, in php.ini
-----------------------------------------------------
Session.cookie_httponly = 1
-----------------------------------------------------

Setting its value to 1 or true to turn on the HttpOnly property of the global cookie, and of course, supports the opening of the Code:

?
123 <?php ini_set("session.cookie_httponly", 1);  // or session_set_cookie_params(0, NULL, NULL, NULL, TRUE); ?>

The cookie manipulation function Setcookie function and the Setrawcookie function are also specifically added with the 7th parameter as an option for HttpOnly, with the opening method:

?
1234 <?phpsetcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); setrawcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE);?>

For previous versions of PHP5.1 and PHP4 versions, you need to use the header function to work around the following:

?
123 <?php header ( "Set-cookie: Hidden=value; HttpOnly " ); ?>
                         ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                                                            ,         &N Bsp                          ,         &NB Sp                          ,         &NB Sp                       &NBSP;&NBSP;&NBSP;&NBSP;&NBSP;HTTP://WWW.SDL cseo.com/629.html 

Everyone in the use of virtual machine to build WordPress blog, I believe will use 360 Web site security detection to check the security of the site, using WordPress blog program build blog How much will be reported some loopholes, today WiFi department arrested X-frame-options head not set The hint, though a slight loophole, looked uncomfortable, so the problem was dealt with.
X-frame-options Header Not set fix method:
One, Apache configuration
Configure Apache to send the x-frame-options response header on all pages, you need to add this line of code to the configuration: Apache configuration httpd.conf first Open mod_header.so extension

    1. Header always append x-frame-options sameorigin

Second, nginx configuration
Configure the Nginx Send X-frame-options response header and add the following line of code to the configuration of ' http ', ' server ' or ' location ':

1.add_header x-frame-options Sameorigin

Third, IIS configuration (virtual machine private)
Configure IIS to send the x-frame-options response header, and add the following code to the Web. config file (for example):

    1. <customHeaders>
    2. <add name="x-frame-options" value="Sameorigin"/>
    3. </customHeaders>

Recent machine room let rectification of the loopholes set cookie HttpOnly x-frame-options header is not set

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.