In front-end development, we can't help but use read/write cookies and dynamically introduce js scripts and other related operations. How can we achieve this? See the following js functions: [javascript] varJsHelper {CreateJS: function (url) {varhdocument. getElementsByTagName... Synt
In front-end development, we can't help but use read/write cookies and dynamically introduce js scripts and other related operations. How can we achieve this? See the following js functions:
[Javascript] var JsHelp
; var I3 = 0; var isdocheck = 'n'; var timecheck; var domainvalue;
Function domaincheck (){Isdocheck = 'y'; // sets the check status to true and then false when initiating a request.Cleartime ();Domainvalue = domainchar [I1] + domainchar [I2] + domainchar [I3]; // + domainchar [I4]; --> fourWhois_api (domainvalue, 'com ');Timecheck = setTimeout ('checkdo () ', 10
//Introducing ModulesvarHTTP = require (' http '), URL= require (' URL '), QueryString= Require (' querystring '), FS= Require (' FS '), DNS= Require (' DNS ');//display fill out the page. Form form for output query by Res.endvarGoindex =function(req, res) {Res.end (");};//DNS parsing functions. Through the Dns.resolve parsing of the DNS module, the parse executes the callback successfully and writes the value to the parameter function in the callback .varGodns =function(PostData, callback) {var
cookie, we can be processed by the response header:[Java]View Plaincopy
Response.setheader ("Set-cookie", "cookiename=value; path=/;D Omain=domainvalue; Max-age=seconds;HttpOnly ");
Cookie ScopeThe scope of the test cookie needs to get several domain names, modify the C:\Windows\System32\drivers\etc\hosts file, map the native IP to four domain names, as follows:[HTML]View Plaincopy
127.0.0.1 web1.ghsau.com
127.0.0.1 web2.g
corresponds to the following class:
Java.lang.Object
|
+--Javax.servlet.http.CookieThe class can set the cookie name, content, action path, scope, protocol, life cycle, but cannot set the HttpOnly property, do not know what to do this is what to consider, if we do not want to set HttpOnly cookie, we can be processed by the response header:
[Java]View Plain copy print? Response.setheader ("Set-cookie", "cookiename=value; path=/;D Omain=domainvalue
See: http://blog.yemou.net/article/query/info/tytfjhfascvhzxcyt3771. What is HttpOnly?If you set the HttpOnly attribute in the cookie, then the JS script will not be able to read the cookie information, so as to effectively prevent XSS attacks, the specific introduction of Google to do a searchDoes the 2.javaEE API support?At present, Sun has not released the relevant API, but PHP, C # are implemented. Java EE brothers are more depressed, do not worry about the following flexible implementationS
, IMG, IFRAME, and link can load resources across domains without being constrained by the same-origin policy.What you can do on the service side1. HttpOnlyIn fact, it is now the HTTP protocol (HTTPS is also possible) to read Cookies,javascript is not read cookies. Supported browsers are ie6+, firefox2+, Google, safari4+.Java EE adds httponly code to a cookie:Response.setheader ("Set-cookie", "cookiename=value; path=/;D Omain=domainvalue; Max-age=seco
. -----------------don't understand it here, it's okay, keep looking down .
4.2 HttpOnly Effect Demo
First look at the example demo:
1.php
We can see what this box is all about.
2.php
We can see through the comparison, there are httponly pages, JS is not able to obtain the contents of the cookie, and no HttpOnly page, JS easy access to cookies without pressure.
Easy to understand: Block client script Access cookie
Sina Weibo XSS, have encountered Ht
;....... Propertyname= "Mappingdirectorylocations"> List> value>Classpath:com/vrv/paw/domainvalue> List> Property> Bean>Extended:Mappingresources, Mappinglocations, mappingdirectorylocationsThe difference between them:1. Mappingresources: Specify the specific mapping file name under Classpathname= "mappingresources"> value >value> Property> 2. Mappinglocations: You can specify any file path, an
can see that this box has no content.
2. php
Through comparison, we can see that JS cannot obtain COOKIES on HTTPONLY pages, but does not have HTTPONLY pages. JS can easily obtain COOKIES without any pressure.
Easy to understand: prevents client scripts from accessing cookies
HTTPONLY has been encountered on Sina Weibo XSS. Even if you get the user's COOKIES through XSS, you cannot access the user's page through the COOKIES. Therefore, HTTPONLY settings are essential for every website!
4.3.
in an application domain. By calling the Thread. GetDomain method, you can determine the domain where the Thread executes.3. The thread spans multiple application domain instances.Using System;Using System. Collections. Generic;Using System. Linq;Using System. Text;Using System. Threading;Namespace AppDomainAndThread{Class Program{Static void Main (string [] args){// Create an application domainAppDomain appdomain = AppDomain. CreateDomain ("MyAppDomain ");Appdomain. SetData ("DomainKey", "
resources across domains without the restriction of the same-source policy.
What the server can do1. HttpOnly
In fact, cookies can be read only through the HTTP protocol (HTTPS can also be used). JavaScript cannot read cookies. Supports IE6 +, Firefox2 +, Google, and Safari4 + browsers.
Java EE adds HttpOnly code to the Cookie:
response.setHeader("Set-Cookie","cookiename=value; Path=/;Domain=domainvalue;Max-Age=seconds;HTTPOnly");
PS: for HTTPS, you
, A thread is still in an application domain
.By calling the Thread. GetDomain method, you can determine the domain where the Thread executes.
3. The thread spans multiple application domain instances.
Using System;Using System. Collections. Generic;Using System. Linq;Using System. Text;Using System. Threading;
Namespace AppDomainAndThread{Class Program{Static void Main (string [] args){// Create an application domainAppDomain appdomain = AppDomain. CreateDomain ("MyAppDomain ");Appdomain. S
using this input parameter, and can return another dto as needed. In the presentation layer to the domain layer, the entity object should not be received or returned, and the DTO mapping should be done. An application service method is generally considered a unit of work. Validation of user input parameters should also be implemented at the application level. ABP provides an infrastructure that makes it easy to implement validation of input parameters. It is recommended to use a tool like AutoM
Response.setheader ("Set-cookie", "cookiename=value;path=/;D Omain=domainvalue; Max-age=seconds; HttpOnly ");
The meaning of the specific parameter is not elaborated again, after the set up through the JS script is not read the cookie, but use the following way can read
Cookie cookies[]=request.getcookies ();
C#
HttpCookie MyCookie = new HttpCookie ("MyCookie");Mycookie.httponly =
alternative node. Just like the previous operation, only two attributes are added, firstname and lastname, respectively. Set the relevant attributes of String Length validator of firstname: lowerbound = 1 lowerboundtype = inclusiveupperbound = 20. Continue to set the domainvalidator attribute of lastname, select domain attribute, and click the corresponding button, the domainvalue collection editor dialog box is displayed.
In this dialog box, add ent
should also be implemented at the application level. ABP provides an infrastructure that makes it easy to implement validation of input parameters. It is recommended to use a tool like AutoMapper to map the entity to the DTO.Domain layer (domain Core)Entities: Entities, domain objects, data and operations that represent the business domainValue objects: Entity modelRepositories: warehousing, used to operate the database for data access. Warehousing i
, IMG, IFRAME, and link can load resources across domains without being constrained by the same-origin policy.What you can do on the service side1. HttpOnlyIn fact, it is now the HTTP protocol (HTTPS is also possible) to read Cookies,javascript is not read cookies. Supported browsers are ie6+, firefox2+, Google, safari4+.Java EE adds httponly code to a cookie:Response.setheader ("Set-cookie", "cookiename=value; path=/;D Omain=domainvalue; Max-age=seco
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.