会话cookie中缺少HttpOnly属性 解决

会话cookie中缺少HttpOnly属性 解决

 

只需要写一个过滤器即可

 1 package com.neusoft.streamone.framework.security.filter;
 2
 3 import java.io.IOException;
 4
 5 import javax.servlet.Filter;
 6 import javax.servlet.FilterChain;
 7 import javax.servlet.FilterConfig;
 8 import javax.servlet.ServletException;
 9 import javax.servlet.ServletRequest;
10 import javax.servlet.ServletResponse;
11 import javax.servlet.http.Cookie;
12 import javax.servlet.http.HttpServletRequest;
13 

20 public class CookieHttpOnlyFilter implements Filter
21 {
22
23     @Override
24     public void destroy()
25     {
26
27     }
28
29     @Override
30     public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException
31     {
32         Cookie[] cookies = ((HttpServletRequest)request).getCookies();
33         if(cookies!=null)
34         {
35             for(Cookie cookie : cookies){
36                 //tomcat7 支持该属性，tomcat6不支持
37                 cookie.setHttpOnly(true);
38             }
39         }
40         filterChain.doFilter(request, response);
41     }
42
43     @Override
44     public void init(FilterConfig arg0) throws ServletException
45     {
46
47     }
48
49 }