django-会话 cookie 中缺少HttpOnly 属性-安全加强

最新推荐文章于 2025-07-07 14:00:49 发布

转载最新推荐文章于 2025-07-07 14:00:49 发布 · 906 阅读

0 ·

CC 4.0 BY-SA版权

原文链接：http://www.cnblogs.com/aguncn/p/10640588.html

文章标签：

#python #javascript #ViewUI

本文介绍如何通过设置CSRF_COOKIE_HTTPONLY为True来增强Django应用程序的安全性，防止客户端JavaScript访问CSRF cookie，并讨论了这一措施的实际效益及应用场景。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

如果django程序扫描到会话 cookie 中缺少 HttpOnly 属性问题，需要如何进行安全加强？

https://docs.djangoproject.com/en/2.2/ref/settings/#std:setting-CSRF_COOKIE_HTTPONLY

参考官方文档.

`CSRF_COOKIE_HTTPONLY`¶

Default: False

Whether to use HttpOnly flag on the CSRF cookie. If this is set to True, client-side JavaScript will not to be able to access the CSRF cookie.

Designating the CSRF cookie as HttpOnly doesn’t offer any practical protection because CSRF is only to protect against cross-domain attacks. If an attacker can read the cookie via JavaScript, they’re already on the same domain as far as the browser knows, so they can do anything they like anyway. (XSS is a much bigger hole than CSRF.)

Although the setting offers little practical benefit, it’s sometimes required by security auditors.

If you enable this and need to send the value of the CSRF token with an AJAX request, your JavaScript must pull the value from a hidden CSRF token form input instead of from the cookie.

See SESSION_COOKIE_HTTPONLY for details on HttpOnly.

在settings.py里，设置 CSRF_COOKIE_HTTPONLY = True即可。

转载于:https://www.cnblogs.com/aguncn/p/10640588.html