01.安全扫描之解决Cookie未设置Secure标识问题

1.问题描述

cookie未设置Secure标识：Cookie中有一个Sevure标识，如果设置了，那么这个cookie只会再https下被发送出去，https的传输时加密的，减少敏感cookie再http明文传输时泄露的可能性

2.解决方案

在web.xml中添加一个对controller的过滤器

<filter>
<filter-name>cookie</filter-name>
<filter-class>com.skycloud.bigdata.bdtm.authority.CookieFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>cookie</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>

CookieFilter.java

package com.skycloud.bigdata.bdtm.authority;

import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Calendar;
import java.util.Date;
import java.util.Locale;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
* Servlet Filter implementation class CookieFilter
*
* 解决 Cookie未设置HttpOnly && Cookie未设置Secure标识问题
*
*/
public class CookieFilter implements Filter {

/**
* Default constructor.
*/
public CookieFilter() {
// TODO Auto-generated constructor stub
}

   /**
   * @see Filter#destroy()
   */
   public void destroy() {
       // TODO Auto-generated method stub
   }

   /**
   * @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain)
   */
   public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
       HttpServletRequest req = (HttpServletRequest)request;
       HttpServletResponse resp = (HttpServletResponse)response;
       Cookie[] cookies = req.getCookies();
       if (cookies != null) {
           for (Cookie cookie : cookies) {
               String value = cookie.getValue();
               StringBuilder builder = new StringBuilder();
               builder.append(cookie.getName()+"="+value+";");
               builder.append("Secure;");//Cookie设置Secure标识
               builder.append("HttpOnly;");//Cookie设置HttpOnly
//               Calendar cal = Calendar.getInstance();//过期时间设置
//               cal.add(Calendar.HOUR, 1);
//               Date date = cal.getTime();
//               Locale locale = Locale.CHINA;
//               SimpleDateFormat sdf = new SimpleDateFormat("dd-MM-yyyy HH:mm:ss",locale);
//               builder.append("Expires="+sdf.format(date));
               System.out.println("cookie--------------------------"+cookie.getName()+"##########"+value+";"+"##########"+cookie.getMaxAge());
               resp.addHeader("Set-Cookie", builder.toString());

           }

       }
       chain.doFilter(request, response);
   }

   /**
   * @see Filter#init(FilterConfig)
   */
   public void init(FilterConfig fConfig) throws ServletException {
       // TODO Auto-generated method stub
   }

}

在设置Set-Cookie的时候，用addHeader，如果用setHeader的话，就只是设置一个cookie值得头信息限制，其实在平时会有很多cookie里的主要参数信息需要限制，有的消息也会有不同的浏览器可以存储的时间，所有要一个一个遍历出来设置Cookie的信息。

受益于https://blog.csdn.net/XiaHeShun/article/details/83339072，感谢

来源：CSDN

作者：bigdata_li

链接：https://blog.csdn.net/bigdata_li/article/details/103918588

标签