java服务器端获取Cookie的httpOnly的值总是false,奇怪了？

r囧r小猫 2022-10-23 01:50 105阅读 0赞

[名称叫JSESSIONID的Cookie，HttpOnly明明是true,服务器端获取的HttpOnly的值始终是false][JSESSIONID_Cookie_HttpOnly_true_HttpOnly_false]

[Java操作Cookie方法][Java_Cookie]

[请求头cookie 的 httpOnly 问题][cookie _ httpOnly]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 1][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 2][]

<!DOCTYPE html>
    <html>
    <head>
    <meta charset="UTF-8">
    <title>javascript读取不到httpOnly属性值等于true的cookie</title>
    <script type="text/javascript">
    window.onload = function() {
    	var divNode = document.getElementById("showCookie");
    	divNode.innerHTML = "cookie如下：<br/>" + document.cookie;
    }
    </script>
    </head>
    <body style="background-color: #CCE8CF;">
    <h2>javascript读取不到httpOnly属性值等于true的cookie</h2>
    <div id="showCookie" style="background-color: Wheat; height: 200px;">
    </div>
    </body>
    </html>

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 4][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 5][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 6][]

package com.test.servlet;
    
    import java.io.IOException;
    import java.util.Enumeration;
    import java.util.UUID;
    
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.Cookie;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    /**
     * 测试Cookie的HttpOnly
     */
    @WebServlet("/TestCookie")
    public class TestCookie extends HttpServlet {
    	private static final long serialVersionUID = 1L;
    
    	protected void doGet(HttpServletRequest request, HttpServletResponse response)
    			throws ServletException, IOException {
    //		String header = response.getHeader("Set-Cookie");
    //		System.out.println(header);
    		Cookie[] cookies = request.getCookies();
    		if (cookies != null) {
    			for (Cookie cookie : cookies) {
    				System.out.println(cookie.getName() + "=" + cookie.getValue() +",httpOnly=" + cookie.isHttpOnly());
    				System.out.println("Domain=" + cookie.getDomain() + ",Path=" + cookie.getPath());
    				System.out.println("-------------------------");
    			}
    		} else {
    			Cookie cookie = new Cookie("access_token", UUID.randomUUID().toString());
    			cookie.setHttpOnly(false);
    			cookie.setPath("/");
    			cookie.setDomain("localhost");
    			response.addCookie(cookie);
    			response.sendRedirect("http://localhost:8888" + request.getContextPath() + "/js.html");
    		}
    		
    		// 获取所有请求头的名称
    		Enumeration<String> headerNames = request.getHeaderNames();
    		while(headerNames.hasMoreElements())
    		{
    		    String headerName = headerNames.nextElement();
    		    // 获取每个请求、及其对应的值
    		    System.out.println(headerName + " = " + request.getHeader(headerName));
    		        
    		}
    	}
    
    	protected void doPost(HttpServletRequest request, HttpServletResponse response)
    			throws ServletException, IOException {
    		doGet(request, response);
    	}
    
    }

访问[http://localhost:8888/javaScript2021/TestCookie][http_localhost_8888_javaScript2021_TestCookie]这个Servlet地址，**运行结果如下： **

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 7][]

access_token=3334b9fe-dcfe-4167-833f-92c9bd1210a9,httpOnly=false
    Domain=null,Path=null
    -------------------------
    test_token=cc50861e-1682-4e7c-9a43-a2caacd9c57c,httpOnly=false
    Domain=null,Path=null
    -------------------------
    my_id=8173206f-df14-4b35-8451-a883bae03de9,httpOnly=false
    Domain=null,Path=null
    -------------------------
    host = localhost:8888
    connection = keep-alive
    cache-control = max-age=0
    dnt = 1
    upgrade-insecure-requests = 1
    user-agent = Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36
    accept = text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
    sec-fetch-site = none
    sec-fetch-mode = navigate
    sec-fetch-user = ?1
    sec-fetch-dest = document
    accept-encoding = gzip, deflate, br
    accept-language = zh-CN,zh;q=0.9
    cookie = access_token=3334b9fe-dcfe-4167-833f-92c9bd1210a9; test_token=cc50861e-1682-4e7c-9a43-a2caacd9c57c; my_id=8173206f-df14-4b35-8451-a883bae03de9

###  **java服务器端获取Cookie的****httpOnly的值总是false,****奇怪了？ ** ###

**cookie是通过请求头中的cookie字段发送到服务器的，服务器解析这段cookie字符串，封装成Cookie\[\]，而浏览器发送cookie时只会发送key-value，所以Cookie其他的字段都是默认值，boolean默认是false。**

[JSESSIONID_Cookie_HttpOnly_true_HttpOnly_false]: https://blog.csdn.net/czh500/article/details/80367612
[Java_Cookie]: https://www.cnblogs.com/mao2080/p/9520185.html
[cookie _ httpOnly]: https://www.jianshu.com/p/159796f69c76
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70]: /images/20221022/75e282fc4a254fd384e933909884bcda.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 1]: /images/20221022/ce901b3a47974d51a5d1296177e658b2.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 2]: /images/20221022/f845996cde054e948193034a9a98cb18.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 3]: /images/20221022/0a772b01c0d04ab7934a1c045ed8376d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 4]: /images/20221022/c0937608e50246dbbabae24c0a381677.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 5]: /images/20221022/cf62f54af7ac415eb34f64651d71e43d.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 6]: /images/20221022/e07f2d041e8246a5ab0043cc89a51c0d.png
[http_localhost_8888_javaScript2021_TestCookie]: http://localhost:8888/javaScript2021/TestCookie
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2N6aDUwMA_size_16_color_FFFFFF_t_70 7]: /images/20221022/3673c003f1274d15a7389f1ea3e31532.png