blocks|key|228381|text|您说得对，手动设置header是实现目标的正确方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|228382|您还可以使用javax.ws.rs.core.NewCookie或任何其他具有有用toString方法的类将cookie打印到标头，以使事情变得更简单。|228383|public+static+String+getHttpOnlyCookieHeader(Cookie+cookie)+{

++++NewCookie+newCookie+=+new+NewCookie(cookie.getName(),+cookie.getValue(),+
++++++++++++cookie.getPath(),+cookie.getDomain(),+cookie.getVersion(),+
++++++++++++cookie.getComment(),+cookie.getMaxAge(),+cookie.getSecure());

++++return+newCookie+%2B+";+HttpOnly";
}|code-block|syntax|javascript|228384|和用法：|228385|response.setHeader("SET-COOKIE",+getHttpOnlyCookieHeader(myOriginalCookie));|228386|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|P|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|Q|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|L|5|F|7|S|8|@]|9|@]|A|$G|H]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

You are right, manually setting header is the right way to achive your goal.

You can also use javax.ws.rs.core.NewCookie or any other class with useful toString method to print cookie to a header to make things more simple.

<pre><code>public static String getHttpOnlyCookieHeader(Cookie cookie) {

 NewCookie newCookie = new NewCookie(cookie.getName(), cookie.getValue(), 
 cookie.getPath(), cookie.getDomain(), cookie.getVersion(), 
 cookie.getComment(), cookie.getMaxAge(), cookie.getSecure());

 return newCookie + "; HttpOnly";
}
</code></pre>

And the usage:

<pre><code>response.setHeader("SET-COOKIE", getHttpOnlyCookieHeader(myOriginalCookie));
</code></pre>

blocks|key|228401|text|此代码无需使用response.setHeader()即可运行|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|228402|public+void+addCookie(String+cookieName,+String+cookieValue,+Integer+maxAge,+HttpServletResponse+response)+{++
++++Cookie+cookie+=+new+Cookie(cookieName,+cookieValue);
++++cookie.setPath(";+HttpOnly;");
++++cookie.setSecure(isSecureCookie);
++++cookie.setMaxAge(maxAge);
++++response.addCookie(cookie);
}|code-block|syntax|javascript|228403|entityMap^0|7|K|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@$9|N|A|O|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|P|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|D|@]|E|$]]]|L|$]]

This code works without using <code>response.setHeader()</code>:

<pre><code>public void addCookie(String cookieName, String cookieValue, Integer maxAge, HttpServletResponse response) { 
 Cookie cookie = new Cookie(cookieName, cookieValue);
 cookie.setPath("; HttpOnly;");
 cookie.setSecure(isSecureCookie);
 cookie.setMaxAge(maxAge);
 response.addCookie(cookie);
}
</code></pre>

blocks|key|228456|text|对于JEE6之前的Java+Enterprise+Edition版本，比如Servlet2.5，您可以在OWASP上找到来自here的变通方法。下面是一个示例：|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|228457|++++/**
+++++*+Issue+a+cookie+to+the+browser
+++++*+
+++++*+@param+response
+++++*+@param+cookieName
+++++*+@param+cookieValue
+++++*+@param+cookiePath
+++++*+@param+maxAgeInSeconds
+++++*/
++++public+static+void+issueCookieHttpOnly(HttpServletResponse+response,+
++++++++++++String+cookieName,+
++++++++++++String+cookieValue,+
++++++++++++String+cookiePath,+
++++++++++++long+maxAgeInSeconds)+{

++++++++Date+expireDate=+new+Date();
++++++++expireDate.setTime+(expireDate.getTime()+%2B+(1000+*+maxAgeInSeconds));
++++++++//+The+following+pattern+does+not+work+for+IE.
++++++++//+DateFormat+df+=+new+SimpleDateFormat("dd+MMM+yyyy+kk:mm:ss+z");

++++++++//+This+pattern+works+for+Firefox,+Chrome,+Safari+and+Opera,+as+well+as+IE.
++++++++DateFormat+df+=+new+SimpleDateFormat("EEE,+dd-MMM-yyyy+kk:mm:ss+z");
++++++++df.setTimeZone(TimeZone.getTimeZone("GMT"));
++++++++String+cookieExpire+=+df.format(expireDate);

++++++++StringBuilder+sb+=+new+StringBuilder(cookieName);
++++++++sb.append("=");
++++++++sb.append(cookieValue);
++++++++sb.append(";expires=");
++++++++sb.append(cookieExpire);
++++++++sb.append(";path=");
++++++++sb.append(cookiePath);
++++++++sb.append(";HttpOnly");

++++++++response.setHeader("SET-COOKIE",+sb.toString());
++++}|code-block|syntax|javascript|228458|entityMap|0|LINK|mutability|MUTABLE|url|https://www.owasp.org/index.php/HttpOnly#Using_Java_to_Set_HttpOnly^0|1Q|4|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

For Java Enterprise Edition versions prior to JEE 6, say Servlet 2.5, you could find a workaround from <a href="https://www.owasp.org/index.php/HttpOnly#Using_Java_to_Set_HttpOnly" rel="nofollow">here</a> at OWASP. Below is an example:

<pre class="lang-java prettyprint-override"><code> /**
 * Issue a cookie to the browser
 * 
 * @param response
 * @param cookieName
 * @param cookieValue
 * @param cookiePath
 * @param maxAgeInSeconds
 */
 public static void issueCookieHttpOnly(HttpServletResponse response, 
 String cookieName, 
 String cookieValue, 
 String cookiePath, 
 long maxAgeInSeconds) {

 Date expireDate= new Date();
 expireDate.setTime (expireDate.getTime() + (1000 * maxAgeInSeconds));
 // The following pattern does not work for IE.
 // DateFormat df = new SimpleDateFormat("dd MMM yyyy kk:mm:ss z");

 // This pattern works for Firefox, Chrome, Safari and Opera, as well as IE.
 DateFormat df = new SimpleDateFormat("EEE, dd-MMM-yyyy kk:mm:ss z");
 df.setTimeZone(TimeZone.getTimeZone("GMT"));
 String cookieExpire = df.format(expireDate);

 StringBuilder sb = new StringBuilder(cookieName);
 sb.append("=");
 sb.append(cookieValue);
 sb.append(";expires=");
 sb.append(cookieExpire);
 sb.append(";path=");
 sb.append(cookiePath);
 sb.append(";HttpOnly");

 response.setHeader("SET-COOKIE", sb.toString());
 }
</code></pre>

blocks|key|228499|text|对于Servlet+API+2.5，您可以使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|228500|response.addHeader("Set-Cookie","name=value;+HttpOnly");|code-block|syntax|javascript|228501|使用response.setHeader()时要小心，因为它会删除所有其他cookie，例如JSESSIONID+cookie。|228502|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

For Servlet API 2.5, you can use

<pre><code>response.addHeader("Set-Cookie","name=value; HttpOnly");
</code></pre>

Be careful with the use of response.setHeader() because it deletes all the other cookies, for example, the JSESSIONID cookie.

blocks|key|446592|text|Spring使用反射来做到这一点，而不会破坏servlet+2.5容器。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|446593|Method+setHttpOnlyMethod+=+ReflectionUtils.findMethod(Cookie.class,+"setHttpOnly",+boolean.class);
if+(setHttpOnlyMethod+!=+null)+{
++++ReflectionUtils.invokeMethod(setHttpOnlyMethod,+cookie,+Boolean.TRUE);++++++
}|code-block|syntax|javascript|446594|但是，setHttpOnly方法仅在Servlet3.0及更高版本上可用。|446595|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

Spring does this using reflection without breaking on servlet 2.5 containers.

<pre><code>Method setHttpOnlyMethod = ReflectionUtils.findMethod(Cookie.class, "setHttpOnly", boolean.class);
if (setHttpOnlyMethod != null) {
 ReflectionUtils.invokeMethod(setHttpOnlyMethod, cookie, Boolean.TRUE); 
}
</code></pre>

However setHttpOnly method is only available on Servlet 3.0 onward only.

blocks|key|228601|text|Cookie+cookie+=+new+Cookie("JSESSIONID",+session.getId());
cookie.setPath("/");
cookie.setMaxAge(-1);
response.addCookie(cookie);|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|228602|实际上，在我的例子中，这段代码并不能准确地工作。|unstyled|228603|路径值不是"/"|offset|length|style|CODE|228604|但是添加这个cookie.setComment(";+HttpOnly;");可以很好地工作！|228605|entityMap^0|0|0|5|3|0|6|X|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|R|8|@]|9|@]|A|$]]|$1|G|3|H|5|F|7|S|8|@$I|T|J|U|K|L]]|9|@]|A|$]]|$1|M|3|N|5|F|7|V|8|@$I|W|J|X|K|L]]|9|@]|A|$]]|$1|O|3|-4|5|F|7|Y|8|@]|9|@]|A|$]]]|P|$]]

<pre><code>Cookie cookie = new Cookie("JSESSIONID", session.getId());
cookie.setPath("/");
cookie.setMaxAge(-1);
response.addCookie(cookie);
</code></pre>

Actually in my case, this code not work exactly. 
Path value are not <code>"/"</code>

But add this <code>cookie.setComment("; HttpOnly;");</code> works fine!

blocks|key|228620|text|如果你不想硬编码HttpOnly;或者不想添加头部，可以像这样使用apache+shiro：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|228621|void+addCookie(javax.servlet.http.Cookie+httpCookie,
+++++++++++++++HttpServletRequest+request,
+++++++++++++++HttpServletResponse+response)+{
++++org.apache.shiro.web.servlet.Cookie+cookie+=
+++++++++++++++++new+org.apache.shiro.web.servlet.SimpleCookie(httpCookie.getName());

++++cookie.setValue(httpCookie.getValue());
++++cookie.setPath(httpCookie.getPath());
++++//+set+other+stuff+from+the+original+httpCookie
++++cookie.setHttpOnly(true);

++++cookie.saveTo(request,+response);
}|code-block|syntax|javascript|228622|entityMap|0|LINK|mutability|MUTABLE|url|https://shiro.apache.org/^0|8|9|X|C|0|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@$9|V|A|W|1|X]]|E|$]]|$1|F|3|G|5|H|7|Y|8|@]|D|@]|E|$I|J]]|$1|K|3|-4|5|6|7|Z|8|@]|D|@]|E|$]]]|L|$M|$5|N|O|P|E|$Q|R]]]]

If you don't want to hardcode <code>HttpOnly;</code> or don't like to add header, use <a href="https://shiro.apache.org/" rel="nofollow noreferrer">apache shiro</a> like this:

<pre><code>void addCookie(javax.servlet.http.Cookie httpCookie,
 HttpServletRequest request,
 HttpServletResponse response) {
 org.apache.shiro.web.servlet.Cookie cookie =
 new org.apache.shiro.web.servlet.SimpleCookie(httpCookie.getName());

 cookie.setValue(httpCookie.getValue());
 cookie.setPath(httpCookie.getPath());
 // set other stuff from the original httpCookie
 cookie.setHttpOnly(true);

 cookie.saveTo(request, response);
}
</code></pre>

here is a function that sets a cookie:

<pre><code>public void addCookie(String cookieName, String cookieValue, Integer maxAge, HttpServletResponse response) {
 Cookie cookie = new Cookie(cookieName, cookieValue);
 cookie.setPath("/mycampaigns");
 cookie.setSecure(isSecureCookie);
 cookie.setMaxAge(maxAge);
 response.addCookie(cookie);
}
</code></pre>

I believe in servlet 3.0, there is a way to do this directly. Unfortunately my organization uses 2.5 and UPGRADING at this juncture IS NOT AN OPTION.

is there way to use the response to set the cookie? Here's an example i found online 

<pre><code>response.setHeader("SET-COOKIE", "[SOME STUFF]" +"; HttpOnly")
</code></pre>

If this is the only way to do what i want, what would i replace "[SOME STUFF]" with so that i don't lose any of the data that my function currently stores in the cookie?

Setting an httponly cookie with javax.servlet 2.5

容器

Java

下面是一个设置cookie的函数：public void addCookie(String cookieName, String cookieValue, Integer maxAge, HttpServletResponse response) {    Cookie cookie = new Cookie(cook...

问使用javax.servlet 2.5设置httponly cookie
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用javax.servlet 2.5设置httponly cookieEN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用javax.servlet 2.5设置httponly cookie
EN