What is HttpOnly

1. What is HttpOnly?

If you set the HttpOnly attribute in the cookie, then the JS script will not be able to read the cookie information, so as to effectively prevent XSS attacks, the specific introduction of Google to do a search

Does the 2.javaEE API support?

At present, Sun has not released the relevant API, but PHP, C # are implemented. Java EE brothers are more depressed, do not worry about the following flexible implementation

Sample setup for 3.HttpOnly

Java EE
Response.setheader ("Set-cookie", "cookiename=value;
path=/;D Omain=domainvalue; Max-age=seconds; HttpOnly ");

The meaning of the specific parameter is not elaborated again, after the set up through the JS script is not read the cookie, but use the following way can read
Cookie cookies[]=request.getcookies ();
C#
HttpCookie MyCookie = new HttpCookie ("MyCookie");
Mycookie.httponly = true;
Response.appendcookie (MyCookie);

vb.net
Dim MyCookie as HttpCookie = new HttpCookie ("MyCookie")
Mycookie.httponly = True
Response.appendcookie (MyCookie)

But in. NET 1.1, you need to manually add
Response.cookies[cookie]. Path + = "; HttpOnly ";

PHP4
Header ("Set-cookie:hidden=value; HttpOnly ");

PHP5
Setcookie ("abc", "Test", NULL, NULL, NULL, NULL, TRUE);

The last parameter is the HttpOnly property

Reference
Http://www.owasp.org/index.php/HTTPOnly

Transferred from: http://yzd.iteye.com/blog/787190

http://www.oschina.net/question/100267_65116

The cookie is set to HttpOnly to prevent XSS attacks and to steal cookie content, which increases the security of the cookie and, even so, does not deposit important information in a cookie.

How to set a cookie in Java is HttpOnly?
The Servlet 2.5 API does not support cookie settings HttpOnly
http://docs.oracle.com/cd/E17802_01/products/products/servlet/2.5/docs/servlet-2_5-mr2/

Recommended upgrade Tomcat7.0, it has been implemented Servlet3.0
Http://tomcat.apache.org/tomcat-7.0-doc/servletapi/javax/servlet/http/Cookie.html

But the hard truth is that the boss won't let you upgrade.
Let's introduce a different approach:
Use HttpResponse's AddHeader method to set the value of the Set-cookie
Format of the cookie string: key=value; Expires=date; Path=path; Domain=domain; Secure; HttpOnly

Set cookies

Response.AddHeader ("Set-cookie", "uid=112; path=/; httponly");

Set multiple cookies

Response.AddHeader ("Set-cookie", "uid=112; path=/; httponly");

Response.AddHeader ("Set-cookie", "TIMEOUT=30; Path=/test; httponly");

Set up a cookie for HTTPS

Response.AddHeader ("Set-cookie", "uid=112; path=/; Secure; httponly");

In practice, we can make firecookie see if the cookie we set is HttpOnly

http://zhenghaoju700.blog.163.com/blog/static/13585951820138267195385/

What is HttpOnly