檢驗-會話cookie中缺少HttpOnly屬性

第一次遇到這樣的問題，就想來記錄下這個。

詳細問題描述：

1.會話cookie中缺少HttpOnly屬性會導致攻擊者可以通過程序(JS腳本、Applet等)獲取到用戶的cookie信息，造成用戶cookie信息泄露，增加攻擊者的跨站腳本攻擊威脅。 
 
2.HttpOnly是微軟對cookie做的擴展，該值指定cookie是否可通過客戶端腳本訪問。Microsoft Internet Explorer 版本 6 Service Pack 1 和更高版本支持cookie屬性HttpOnly。 
 
3.如果在Cookie中沒有設置HttpOnly屬性爲true，可能導致Cookie被竊取。竊取的Cookie可以包含標識站點用戶的敏感信息，如ASP.NET會話ID或Forms身份驗證票證，攻擊者可以重播竊取的Cookie，以便僞裝成用戶或獲取敏感信息，進行跨站腳本攻擊等。 
 
4.如果在Cookie中設置HttpOnly屬性爲true，兼容瀏覽器接收到HttpOnly cookie，那麼客戶端通過程序(JS腳本、Applet等)將無法讀取到Cookie信息，這將有助於緩解跨站點腳本威脅。

那麼我們該怎樣去解決這個問題呢？很簡單只需要一個攔截器即可：

代碼如下：

CookieHttpOnlyFilter.java:

package org._common.filter;

import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.Date;
import java.util.Locale;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
 * 解決檢測到會話cookie中缺少HttpOnly屬性的問題
 * @author kf0101
 *
 */
public class CookieHttpOnlyFilter implements Filter {
 
 public void destroy() {

 }

 public void doFilter(ServletRequest request, ServletResponse response,
   FilterChain filterChain) throws IOException, ServletException {
  // TODO Auto-generated method stub
        HttpServletRequest req = (HttpServletRequest) request; 
        HttpServletResponse resp = (HttpServletResponse) response;
  Cookie[] cookies = req.getCookies();
   if(cookies!=null){
    for(Cookie cookie : cookies){
     String value = cookie.getValue(); 
              StringBuilder builder = new StringBuilder(); 
              builder.append("JSESSIONID=" + value + "; "); 
              builder.append("Secure; "); 
              builder.append("HttpOnly; "); 
              Calendar cal = Calendar.getInstance(); 
              cal.add(Calendar.HOUR, 1); 
              Date date = cal.getTime(); 
              Locale locale = Locale.CHINA; 
              SimpleDateFormat sdf = new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale); 
              builder.append("Expires=" + sdf.format(date)); 
              resp.setHeader("Set-Cookie", builder.toString());
    }
    filterChain.doFilter(request, response);
   }
 }

 public void init(FilterConfig arg0) throws ServletException {
  // TODO Auto-generated method stub

 }
}

然後在配置文件中進行配置：

web.xml:

<filter> 
        <filter-name>cookieHttpOnlyFilter</filter-name> 
        <filter-class>org._common.filter.CookieHttpOnlyFilter</filter-class>  
  </filter> 

<filter-mapping> 
        <filter-name>cookieHttpOnlyFilter</filter-name> 
        <url-pattern>/*</url-pattern>  
  </filter-mapping>  
  <filter>

然後我們來測試下用F12看下：

那麼這樣就好了。