search

ls0f / my-issues

0 stars 0 forks source link

任何时候都应该给关键cookie带上httponly选项 #8

Open ls0f opened 8 years ago

ls0f commented 8 years ago

详情参看 https://www.owasp.org/index.php/HttpOnly#What_is_HttpOnly.3F

主流浏览器都支持这个选项了，用来防止XSS攻击，但对于嗅探和中间人攻击还是得靠HTTPS。