Cookie HttpOnly Secure

Cookie HttpOnly Secure

1. Change the configuration on context.xml
<Context cookies="true" crossContext="true">
   <SessionCookie secure="true" httpOnly="true" />
   <!-- Session persistence is disable by default. To enable for all web
   apps set the pathname to a non-empty value:
   <Manager pathname="SESSIONS.ser" />

   To enable session persistence for a single web app, add a
   WEB-INF/context.xml
   -->
   <Manager pathname="" />

   <!-- Install an InstanceListener to handle the establishment of the run-as
   role for servlet init/destroy events.
   -->
   <InstanceListener>org.jboss.web.tomcat.security.RunAsListener</InstanceListener>

</Context>

2. Use response to write cookie back
Cookie[] cookies = ((HttpServletRequest) request).getCookies();
for (Cookie cookie : cookies){
if (cookie.getName().equalsIgnoreCase("JSESSIONID")){
     ((HttpServletResponse)response).setHeader("SET-COOKIE", String.format("%s=%s;Path=/storename;HttpOnly", cookie.getName(), session.getId()));
     cookie.setSecure(true);
}else{
      ((HttpServletResponse)response).setHeader("SET-COOKIE", String.format("%s=%s;Path=/storename;HttpOnly", cookie.getName(), cookie.getValue()));
      cookie.setSecure(true);
      }
}

Or

HttpSession session = ((HttpServletRequest)request).getSession(false);
if(null != session && Utility.isValidString(session.getId())){
                String sessionid = session.getId();
                Log.info(this, "session create time:  "+session.getCreationTime());
                ((HttpServletResponse)response).setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + ";HttpOnly");
}

Or

HttpSession session = ((HttpServletRequest)request).getSession(false);
if(null != session && Utility.isValidString(session.getId())){
String sessionid = session.getId();
    Log.info(this, "session create time:  "+session.getCreationTime());
    ((HttpServletResponse)response).setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + ";HttpOnly;Path=/storename;secure=true");
}

references:
https://community.jboss.org/thread/165079
http://www.iteye.com/problems/80699

评论

1 楼 vae_in_zdsoft 2012-12-20  

我想问下 当服务器端想取httpOnly的cookie能取到么