JAVA设置HttpOnly Cookies

最新推荐文章于 2025-07-07 14:00:49 发布

原创最新推荐文章于 2025-07-07 14:00:49 发布 · 5.1k 阅读

3 ·

CC 4.0 BY-SA版权

javaweb_实践问题汇总同时被 2 个专栏收录

141 篇文章

订阅专栏

安全

2 篇文章

订阅专栏

本文详细介绍了如何在Spring Security框架下管理用户的Cookie和Session，包括如何设置HttpOnly属性增强安全性，以及如何通过Session存储用户信息。同时，文章还讨论了在登录处理过程中对手机号和密码的验证流程。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

核心：
1.获取cookie
Cookie[] cookies = request.getCookies();
2.判断cookie是存储用户信息的，设置HttpOnly
for (Cookie cookie2 : cookies) {
System.out.println(cookie2.getName());
System.out.println(cookie2);
if (cookie2.getName().toUpperCase().equals(“JSESSIONID”)) {
cookie2.setHttpOnly(true);
}
}

@RequestMapping("/login")
	public @ResponseBody Map<String, Object> loginHandle(
			@RequestParam(value = "mPhone", required = true) String mPhone,
			@RequestParam(value = "password", required = true) String password,
			@RequestParam(value = "projectId", required = false) Long projectId,
			@RequestParam(value = "productId", required = false) Long productId,
			HttpServletRequest request, Model uiModel
			/**
			 * 直接这样获取cookie会报错	
			 * org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.http.Cookie]: No default constructor found; nested exception is java.lang.NoSuchMethodException: javax.servlet.http.Cookie.<init>()

			 */
			//,Cookie cookie
			) {
		Map<String, Object> retMap = new HashMap<String, Object>();
		retMap.put("retCode", 0);// 0标识失败，1标识成功
		if (StringUtils.isBlank(mPhone) || StringUtils.isBlank(password)) {
			retMap.put("retMsg", "请填写用户名或密码");
			return retMap;
		}
		// 判断手机号是否存在
		UserInfo userInfo = userInfoService.getUserInfoByMphone(mPhone);
		if (null == userInfo) {
			retMap.put("retMsg", "手机号未注册");
			return retMap;
		}
		userInfo = userInfoService.loginHandle(mPhone, password);
		if (null == userInfo) {
			retMap.put("retMsg", "密码与手机号不匹配，请重新输入");
			LogUtil.syslog(sqlSession, "用户登录", mPhone + "登录失败");
			return retMap;
		}
		HttpSession session = request.getSession();
		session.getId();
		
		session.setAttribute("webverifyCodeStatus", true);// 验证码验证通过
		session.setAttribute("webuserInfo", userInfo);
		//cookie.setHttpOnly(true);
		//System.out.println(cookie);
		Cookie[] cookies = request.getCookies();
		/**
		 * 一般有几个cookie，但是我们一般需要的是JSESSIONID
		 * Cookie: login_remember=true; login_phone=xxx; JSESSIONID=AB34EC3B5A3A530330BB719B8836FFEF
		 */
		for (Cookie cookie2 : cookies) {
			System.out.println(cookie2.getName());
			System.out.println(cookie2);
			if (cookie2.getName().toUpperCase().equals("JSESSIONID")) {
				cookie2.setHttpOnly(true);
			}
		}
		
		
		// 携带产品信息时，将webnoProduct设置为false
		if (null != projectId && null != productId) {
			session.setAttribute("webproductId", productId);
			session.setAttribute("webprojectId", projectId);
			session.setAttribute("webnoProduct", false);
			//TODO 20170328 begin 临时检查是否出现了返回的信息中,是否出现了项目id与产品中的id不一致的情况
			Long check_project_id = (Long) session.getAttribute("webprojectId");
			Long check_product_id = (Long) session.getAttribute("webproductId");
			Product check_product = productService.getProduct(check_product_id);
			if (null != check_product && !check_product.getProject().equals(check_project_id)) {
				LogUtil.syslog(sqlSession, "登录中出现产品与项目不一致",
						"session中的项目:" + check_project_id + ", 产品中的项目"
								+ check_product.getProject() + ",session中的产品:"
								+ check_product_id);
			}
			//TODO 20170328 END
		} else {
			session.setAttribute("webnoProduct", true);
		}
		retMap.put("retCode", 1);
		// 记录日志
		UserLog userlog = new UserLog();
		userlog.setProject(userInfo.getProject());
		userlog.setType("登录成功");
		userlog.setInfo(userInfo.getmPhone() + "登录成功");
		userlog.setHostId("未知");
		userlog.setSn(null == userInfo.getUniqueId() ? null : userInfo
				.getUniqueId());
		LogUtil.userlog(sqlSession, userlog);
		return retMap;// "ixinweb/xuanzeqiye";
	}