Cookie中的HttpOnly

1.什么是HttpOnly? 

如果您在cookie中设置了HttpOnly属性，那么通过js脚本将无法读取到cookie信息，这样能有效的防止XSS攻击，具体一点的介绍请google进行搜索

2.javaEE的API是否支持?

 目前sun公司还没有公布相关的API，但PHP、C#均有实现。搞javaEE的兄弟们比较郁闷了，别急下文有变通实现

 3.HttpOnly的设置样例 

javaEE

1 2	response.setHeader("Set-Cookie", "cookiename=value; Path=/;Domain=domainvalue;Max-Age=seconds;HTTPOnly");

具体参数的含义再次不做阐述，设置完毕后通过js脚本是读不到该cookie的，但使用如下方式可以读取 

1	Cookie cookies[]=request.getCookies();

C# 

1 2 3

HttpCookie myCookie = new HttpCookie("myCookie");   myCookie.HttpOnly = true;   Response.AppendCookie(myCookie);

 VB.NET 

1 2 3

Dim myCookie As HttpCookie = new HttpCookie("myCookie")   myCookie.HttpOnly = True   Response.AppendCookie(myCookie)

    但是在 .NET 1.1 ,中您需要手动添加 

1	Response.Cookies[cookie].Path += ";HTTPOnly";

 PHP4 

1	header("Set-Cookie: hidden=value; httpOnly");

PHP5 

1	setcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE);

     最后一个参数为HttpOnly属性

----------------------------------------------------------------------------------

webBrowser

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;

namespace WindowsFormsApplication1
{
    /// <summary>
    /// WinInet.dll wrapper
    /// </summary>
    internal static class CookieReader
    {


        private const int INTERNET_COOKIE_HTTPONLY = 0x00002000;


        [DllImport("wininet.dll", SetLastError = true)]
        private static extern bool InternetGetCookieEx(
            string url,
            string cookieName,
            StringBuilder cookieData,
            ref int size,
            int flags,
            IntPtr pReserved);
        public static string GetCookie(string url)
        {
            int size = 512;
            StringBuilder sb = new StringBuilder(size);
            if (!InternetGetCookieEx(url, null, sb, ref size, INTERNET_COOKIE_HTTPONLY, IntPtr.Zero))
            {
                if (size < 0)
                {
                    return null;
                }
                sb = new StringBuilder(size);
                if (!InternetGetCookieEx(url, null, sb, ref size, INTERNET_COOKIE_HTTPONLY, IntPtr.Zero))
                {
                    return null;
                }
            }
            return sb.ToString();
        }
    }
}

　　

********************************************************************************************************************************************************

using System; 
using System.ComponentModel; 
using System.Net; 
using System.Runtime.InteropServices; 
using System.Security; 
using System.Security.Permissions; 
using System.Text; 

namespace CookieHandler 
{ 
    internal sealed class INativeMethods 
    { 
        #region enums 

        public enum ErrorFlags 
        { 
            ERROR_INSUFFICIENT_BUFFER = 122, 
            ERROR_INVALID_PARAMETER = 87, 
            ERROR_NO_MORE_ITEMS = 259 
        } 

        public enum InternetFlags 
        { 
            INTERNET_COOKIE_HTTPONLY = 8192, //Requires IE 8 or higher      
            INTERNET_COOKIE_THIRD_PARTY = 131072, 
            INTERNET_FLAG_RESTRICTED_ZONE = 16 
        } 

        #endregion 

        #region DLL Imports 

        [SuppressUnmanagedCodeSecurity, SecurityCritical, DllImport("wininet.dll", EntryPoint = "InternetGetCookieExW", CharSet = CharSet.Unicode, SetLastError = true, ExactSpelling = true)] 
        internal static extern bool InternetGetCookieEx([In] string Url, [In] string cookieName, [Out] StringBuilder cookieData, [In, Out] ref uint pchCookieData, uint flags, IntPtr reserved); 

        #endregion 
    } 
} 

　　

using System; 
using System.Collections.Generic; 
using System.ComponentModel; 
using System.Net; 
using System.Runtime.InteropServices; 
using System.Security; 
using System.Security.Permissions; 
using System.Text; 

namespace CookieHandler 
{ 
    /// <SUMMARY></SUMMARY> 
    /// 取得WebBrowser的完整Cookie。 
    /// 因为默认的webBrowser1.Document.Cookie取不到HttpOnly的Cookie 
    /// IE7不兼容，IE8可以，其它未知 
    /// 
    public class FullWebBrowserCookie 
    { 
        public static Dictionary<string, string> GetCookieList(Uri uri, bool throwIfNoCookie) 
        { 
            Dictionary<string, string> dict = new Dictionary<string, string>(); 
            string cookie = GetCookieInternal(uri, throwIfNoCookie); 
            Console.WriteLine("FullWebBrowserCookie - 所有cookie:" + cookie); 
            string[] arrCookie = cookie.Split(';'); 
            foreach (var item in arrCookie) 
            { 
                string[] arr = item.Split('='); 
                string key = arr[0].Trim(); 
                string val = ""; 
                if (arr.Length >= 2) 
                { 
                    val = arr[1].Trim(); 
                } 

                if (!dict.ContainsKey(key)) 
                { 
                    dict.Add(key, val); 
                } 
            } 
            Console.WriteLine("FullWebBrowserCookie - cookie已载入dict，共" + dict.Count.ToString() + "项"); 

            return dict; 
        } 

        public static string GetCookieValue(string key, Uri uri, bool throwIfNoCookie) 
        { 
            Console.WriteLine("GetCookieValue"); 
            Dictionary<string, string> dict = GetCookieList(uri, throwIfNoCookie); 

            if (dict.ContainsKey(key)) 
            { 
                return dict[key]; 
            } 
            return ""; 
        } 

        [SecurityCritical] 
        public static string GetCookieInternal(Uri uri, bool throwIfNoCookie) 
        { 
            Console.WriteLine("GetCookieInternal"); 

            uint pchCookieData = 0; 
            string url = UriToString(uri); 
            uint flag = (uint)INativeMethods.InternetFlags.INTERNET_COOKIE_HTTPONLY; 

            //Gets the size of the string builder      
            if (INativeMethods.InternetGetCookieEx(url, null, null, ref pchCookieData, flag, IntPtr.Zero)) 
            { 
                pchCookieData++; 
                StringBuilder cookieData = new StringBuilder((int)pchCookieData); 

                //Read the cookie      
                if (INativeMethods.InternetGetCookieEx(url, null, cookieData, ref pchCookieData, flag, IntPtr.Zero)) 
                { 
                    DemandWebPermission(uri); 
                    return cookieData.ToString(); 
                } 
            } 

            int lastErrorCode = Marshal.GetLastWin32Error(); 

            if (throwIfNoCookie || (lastErrorCode != (int)INativeMethods.ErrorFlags.ERROR_NO_MORE_ITEMS)) 
            { 
                throw new Win32Exception(lastErrorCode); 
            } 

            return null; 
        } 

        private static void DemandWebPermission(Uri uri) 
        { 
            string uriString = UriToString(uri); 

            if (uri.IsFile) 
            { 
                string localPath = uri.LocalPath; 
                new FileIOPermission(FileIOPermissionAccess.Read, localPath).Demand(); 
            } 
            else
            { 
                new WebPermission(NetworkAccess.Connect, uriString).Demand(); 
            } 
        } 

        private static string UriToString(Uri uri) 
        { 
            if (uri == null) 
            { 
                throw new ArgumentNullException("uri"); 
            } 

            UriComponents components = (uri.IsAbsoluteUri ? UriComponents.AbsoluteUri : UriComponents.SerializationInfoString); 
            return new StringBuilder(uri.GetComponents(components, UriFormat.SafeUnescaped), 2083).ToString(); 
        } 
    } 
}