当前位置：文江博客话题详情

到底如何在 ASP.NET 中配置 httpOnlyCookies？

发布于 2024-07-04 02:23:38 字数 170 浏览 8 评论 0原文

受这篇 CodingHorror 文章“保护您的 Cookie：HttpOnly”的启发，

您如何设置这个性质？在网络配置的某个地方？

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

锦欢 2024-07-11 02:23:38

借助 Rick 的支持（提到的博客文章中的第二条评论），这里是关于 httpOnlyCookies 的 MSDN 文章。

最重要的是，您只需在 web.config 的 system.web 部分中添加以下部分：

<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />

With props to Rick (second comment down in the blog post mentioned), here's the MSDN article on httpOnlyCookies.

Bottom line is that you just add the following section in your system.web section in your web.config:

<httpCookies domain="" httpOnlyCookies="true|false" requireSSL="true|false" />

回复收藏 0 原文

ˇ宁静的妩媚 2024-07-11 02:23:38

如果您使用的是 ASP.NET 2.0 或更高版本，则可以在 Web.config 文件中将其打开。在中部分，添加以下行：

<httpCookies httpOnlyCookies="true"/>

If you're using ASP.NET 2.0 or greater, you can turn it on in the Web.config file. In the <system.web> section, add the following line:

<httpCookies httpOnlyCookies="true"/>

回复收藏 0 原文

深府石板幽径 2024-07-11 02:23:38

有趣的是，在 ASP.NET 2.0 中放置似乎并没有禁用 httpOnlyCookies 。查看这篇关于 ASP .NET 2.0 的 SessionID 和登录问题。

看起来 Microsoft 决定不允许您从 web.config 禁用它。查看forums.asp.net 上的帖子

回复收藏 0 原文

追星践月 2024-07-11 02:23:38

如果您想在代码中执行此操作，请使用系统。 Web.HttpCookie.HttpOnly 属性。

这直接来自 MSDN 文档：

// Create a new HttpCookie.
HttpCookie myHttpCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());
// By default, the HttpOnly property is set to false 
// unless specified otherwise in configuration.
myHttpCookie.Name = "MyHttpCookie";
Response.AppendCookie(myHttpCookie);
// Show the name of the cookie.
Response.Write(myHttpCookie.Name);
// Create an HttpOnly cookie.
HttpCookie myHttpOnlyCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());
// Setting the HttpOnly value to true, makes
// this cookie accessible only to ASP.NET.
myHttpOnlyCookie.HttpOnly = true;
myHttpOnlyCookie.Name = "MyHttpOnlyCookie";
Response.AppendCookie(myHttpOnlyCookie);
// Show the name of the HttpOnly cookie.
Response.Write(myHttpOnlyCookie.Name);

在代码中执行此操作允许您有选择地选择哪些 cookie 是 HttpOnly，哪些不是。

If you want to do it in code, use the System.Web.HttpCookie.HttpOnly property.

This is directly from the MSDN docs:

// Create a new HttpCookie.
HttpCookie myHttpCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());
// By default, the HttpOnly property is set to false 
// unless specified otherwise in configuration.
myHttpCookie.Name = "MyHttpCookie";
Response.AppendCookie(myHttpCookie);
// Show the name of the cookie.
Response.Write(myHttpCookie.Name);
// Create an HttpOnly cookie.
HttpCookie myHttpOnlyCookie = new HttpCookie("LastVisit", DateTime.Now.ToString());
// Setting the HttpOnly value to true, makes
// this cookie accessible only to ASP.NET.
myHttpOnlyCookie.HttpOnly = true;
myHttpOnlyCookie.Name = "MyHttpOnlyCookie";
Response.AppendCookie(myHttpOnlyCookie);
// Show the name of the HttpOnly cookie.
Response.Write(myHttpOnlyCookie.Name);

Doing it in code allows you to selectively choose which cookies are HttpOnly and which are not.

回复收藏 0 原文

~没有更多了~