当启用 cookies HTTPOnly 时，Primefaces 监视器下载停止不起作用
我正在使用 Primefaces 11.0.0 我有一个下载文件组件，如下所示：
<p:commandButton
onclick="PrimeFaces.monitorDownload(startDownload, stopDownload);"
ajax="false"
icon="fa fa-download">
<p:fileDownload value="#{downloadBean.getDownloadFile(document.id)}"/>
</p:commandButton>
我的应用程序在 Nginx 后面的 tomcat 上运行 我们有一个安全建议，将 HTTPOnly,Secure 添加到我们的 cookie 中 所以在Nginx上配置HTTPOnly到cookie时 stopDownload 永远不会被调用。
我的 Nginx 配置如下：
location /myapp {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_cookie_path /myapp "/myapp; HTTPOnly; Secure";
}
How to make stopDownload Works with HTTPOnly ?
编辑：
我可以通过将 HTTPOnly 设置为重要的会话 cookie 来使其工作，如下所示：
proxy_cookie_flags ~ Secure;
proxy_cookie_flags JSESSIONID HTTPOnly Secure;
这是最佳实践还是有更好的解决方案？
I am using Primefaces 11.0.0
and I have a download file component as follows :
<p:commandButton
onclick="PrimeFaces.monitorDownload(startDownload, stopDownload);"
ajax="false"
icon="fa fa-download">
<p:fileDownload value="#{downloadBean.getDownloadFile(document.id)}"/>
</p:commandButton>
My application is running on tomcat behind Nginx
and we have a security recommendation to add HTTPOnly,Secure to our cookies
so when configuring the HTTPOnly to cookies on Nginx
the stopDownload is never get called.
My Nginx config is as follows:
location /myapp {
proxy_pass http://localhost:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_cookie_path /myapp "/myapp; HTTPOnly; Secure";
}
How to make stopDownload works with HTTPOnly ?
EDIT:
I was able to make it work by setting HTTPOnly to important session cookies as follows :
proxy_cookie_flags ~ Secure;
proxy_cookie_flags JSESSIONID HTTPOnly Secure;
Is this is the best practice or there's a better solution ?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这是正确的。
因为 Monitor Download 需要使用 JavaScript 访问 cookie 来“停止下载”，所以 cookie 不能是 HTTP Only，这就是您的代码被破坏的原因。
您的 JSESSIONID cookie 绝对正确地锁定它。我认为您上面的配置是正确的。
That is correct.
Because Monitor Download needs to access the cookie with JavaScript to "stop the download" that cookie can not be HTTP Only which is why your code is breaking.
Your JSESSIONID cookie absolutely is correct to lock it down. In my opinion your configuration above is correct.