如何让 Devise 的 Rememberable 模块使用 http_only 作为记住我的 cookie？
默认情况下，rails 会话 cookie 是 HttpOnly，但 Devise 的 Rememberable 模块设置的 remember_user_token cookie 不是。
据我了解，发送 cookie 时将导致用户收到一个新的会话 cookie，因此它肯定容易受到 XSS 攻击。
那么有什么办法可以将其设置为HttpOnly吗？
The rails session cookie is HttpOnly by default but the remember_user_token cookie set by Devise's Rememberable module is not.
As I understand it that cookie when sent will result in the user being issued a new session cookie, so surely it's as vulnerable to XSS.
So is there any way to set it to HttpOnly?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在#rubyonrails 上@camonz 的帮助下，我想出了这个猴子补丁：
https://gist.github.com/749289
在 Devise 1.1.3 中，cookie 选项是硬编码的，因此我认为猴子补丁是唯一可行的。
然而，Devise 1.2rc 看起来它将允许配置，因为它引入了
resource.cookie_options（例如，从用户模型中提取 cookie_options，所以你应该能够以某种方式在那里设置它 - 还没有想到）还没出来）。PS我还没想出如何测试这个。要在 Chrome 中手动测试，请切换到设置 cookie 的选项卡，使用 Alt + Cmd + I 打开开发人员工具，切换到“存储”选项卡，单击“Cookies”下的项目（在我的例子中为 localhost），然后查看 HTTP柱子。如果 cookie 是 HttpOnly，则会有一个勾号。作为参考，rails 会话 cookie 默认情况下称为
_session_id，默认情况下为 HttpOnly。With the help of @camonz on #rubyonrails I came up with this monkey patch:
https://gist.github.com/749289
In Devise 1.1.3 the cookie options are hardcoded so a monkey patch is all I could think would work.
However, Devise 1.2rc looks like it will allow configuration because it pulls in
resource.cookie_options(e.g. pulling cookie_options from the User model, so you should be able to set it there somehow - haven't figured that out yet).P.S. I haven't figured out how to test this yet. To test manually in Chrome switch to the tab the cookie is set in, open Developer Tools with Alt + Cmd + I, switch to the Storage tab, click the item under 'Cookies' (localhost in my case), and look at the HTTP column. There'll be a tick if the cookie is HttpOnly. For reference the rails session cookie, called
_session_idby default, is HttpOnly by default.