JAVA设置HttpOnly Cookies

ゝ一世哀愁。 2022-03-17 04:56 438阅读 0赞

核心：  
1.获取cookie  
Cookie\[\] cookies = request.getCookies();  
2.判断cookie是存储用户信息的，设置HttpOnly  
for (Cookie cookie2 : cookies) \{  
System.out.println(cookie2.getName());  
System.out.println(cookie2);  
if (cookie2.getName().toUpperCase().equals(“JSESSIONID”)) \{  
cookie2.setHttpOnly(true);  
\}  
\}

@RequestMapping("/login")
    	public @ResponseBody Map<String, Object> loginHandle(
    			@RequestParam(value = "mPhone", required = true) String mPhone,
    			@RequestParam(value = "password", required = true) String password,
    			@RequestParam(value = "projectId", required = false) Long projectId,
    			@RequestParam(value = "productId", required = false) Long productId,
    			HttpServletRequest request, Model uiModel
    			/**
    			 * 直接这样获取cookie会报错	
    			 * org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.http.Cookie]: No default constructor found; nested exception is java.lang.NoSuchMethodException: javax.servlet.http.Cookie.<init>()
    
    			 */
    			//,Cookie cookie
    			) {
    		Map<String, Object> retMap = new HashMap<String, Object>();
    		retMap.put("retCode", 0);// 0标识失败，1标识成功
    		if (StringUtils.isBlank(mPhone) || StringUtils.isBlank(password)) {
    			retMap.put("retMsg", "请填写用户名或密码");
    			return retMap;
    		}
    		// 判断手机号是否存在
    		UserInfo userInfo = userInfoService.getUserInfoByMphone(mPhone);
    		if (null == userInfo) {
    			retMap.put("retMsg", "手机号未注册");
    			return retMap;
    		}
    		userInfo = userInfoService.loginHandle(mPhone, password);
    		if (null == userInfo) {
    			retMap.put("retMsg", "密码与手机号不匹配，请重新输入");
    			LogUtil.syslog(sqlSession, "用户登录", mPhone + "登录失败");
    			return retMap;
    		}
    		HttpSession session = request.getSession();
    		session.getId();
    		
    		session.setAttribute("webverifyCodeStatus", true);// 验证码验证通过
    		session.setAttribute("webuserInfo", userInfo);
    		//cookie.setHttpOnly(true);
    		//System.out.println(cookie);
    		Cookie[] cookies = request.getCookies();
    		/**
    		 * 一般有几个cookie，但是我们一般需要的是JSESSIONID
    		 * Cookie: login_remember=true; login_phone=xxx; JSESSIONID=AB34EC3B5A3A530330BB719B8836FFEF
    		 */
    		for (Cookie cookie2 : cookies) {
    			System.out.println(cookie2.getName());
    			System.out.println(cookie2);
    			if (cookie2.getName().toUpperCase().equals("JSESSIONID")) {
    				cookie2.setHttpOnly(true);
    			}
    		}
    		
    		
    		// 携带产品信息时，将webnoProduct设置为false
    		if (null != projectId && null != productId) {
    			session.setAttribute("webproductId", productId);
    			session.setAttribute("webprojectId", projectId);
    			session.setAttribute("webnoProduct", false);
    			//TODO 20170328 begin 临时检查是否出现了返回的信息中,是否出现了项目id与产品中的id不一致的情况
    			Long check_project_id = (Long) session.getAttribute("webprojectId");
    			Long check_product_id = (Long) session.getAttribute("webproductId");
    			Product check_product = productService.getProduct(check_product_id);
    			if (null != check_product && !check_product.getProject().equals(check_project_id)) {
    				LogUtil.syslog(sqlSession, "登录中出现产品与项目不一致",
    						"session中的项目:" + check_project_id + ", 产品中的项目"
    								+ check_product.getProject() + ",session中的产品:"
    								+ check_product_id);
    			}
    			//TODO 20170328 END
    		} else {
    			session.setAttribute("webnoProduct", true);
    		}
    		retMap.put("retCode", 1);
    		// 记录日志
    		UserLog userlog = new UserLog();
    		userlog.setProject(userInfo.getProject());
    		userlog.setType("登录成功");
    		userlog.setInfo(userInfo.getmPhone() + "登录成功");
    		userlog.setHostId("未知");
    		userlog.setSn(null == userInfo.getUniqueId() ? null : userInfo
    				.getUniqueId());
    		LogUtil.userlog(sqlSession, userlog);
    		return retMap;// "ixinweb/xuanzeqiye";
    	}