如何在JSF / Richfaces上设置HttpOnly标志

I'd like to add the HttpOnly flag to JSF/richfaces cookies, especially the session cookie, to up the level of security on my web app. Any ideas?

我想将HttpOnly标志添加到JSF / richfaces cookie,特别是会话cookie,以提高我的Web应用程序的安全级别。有任何想法吗?

4 个解决方案

#1

There may be something that allows you to do this in your servlet engine. This is part of the Servlet 3.0 spec which is yet to be released.

可能有些东西允许你在servlet引擎中执行此操作。这是Servlet 3.0规范的一部分,尚未发布。

#2

FacesContext facesContext = FacesContext.getCurrentInstance().getFacesContext();

HttpServletResponse response = (HttpServletResponse) facesContext.getExternalContext().getResponse();

response.addHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");

#3

Something like:

response.setHeader("Set-Cookie", "yourcookiename=yourcookievalue; HTTPOnly");

might work in a Java environment. I am not aware of a JSF-specific way to achieve this... sorry

可能在Java环境中工作。我不知道特定于JSF的方法来实现这个...抱歉

This seems to be not an easy task in Java.

这在Java中似乎不是一件容易的事。

#4

I suspect that I'll need to use a filter to add a response wrapper, which'll add the flag to all cookies as they're added by the framework.

我怀疑我需要使用过滤器来添加响应包装器,它会在框架添加时将标志添加到所有cookie中。

#1