如何通过直接处理 Http 标头来使用 HttpOnly 更新 cookie JSESSIONID？

发布于 2024-10-12 23:48:27 字数 676 浏览 4 评论 0原文

这是大局

我想将“HttpOnly”附加到 JSESSIONID Cookie，但我想手动执行此操作，意思是：

//create a new cookie
StringBuilder updatedCookie = new StringBuilder("JSESSIONID").append("=")
                .append(sessionId).append("; Path=").append("/")
                .append("; HttpOnly");

//save the cookie
response.setHeader("SET-COOKIE", updatedCookie.toString());

这是在映射到所有站点的 Servlet Filter 中完成的（过滤器的 url 模式为“/*”）

如何使该过滤器仅运行一次？也就是说，在登录时，或者
我是否真的必须在每个请求时运行并检查此 cookie 是否已被标记，如果答案为“是”则跳过？

有什么建议吗？

PS：

不要告诉我升级到Servlet 3.0，因为我现在做不到
忽略StringBuilder的不当使用和缺少变量sessionId

原文

Here is the big picture

I want to append "HttpOnly" to the JSESSIONID Cookie, but I want to do this by hand, meaning:

//create a new cookie
StringBuilder updatedCookie = new StringBuilder("JSESSIONID").append("=")
                .append(sessionId).append("; Path=").append("/")
                .append("; HttpOnly");

//save the cookie
response.setHeader("SET-COOKIE", updatedCookie.toString());

This is done in a Servlet Filter, that is mapped to all the site (the filter has the url pattern as "/*")

How can I make this filter run only once ? That is, at the login, or
Do I really have to run at each request and check if this cookie has been already marked and skip if the answer is "yes" ?

Any suggestions ?

PS: