HttpServletRequest.getCookies():Array,为什么isHttpOnly()函数总是返回false？

Question

嗨我到目前为止尝试使用httponly cookie这是我编写的代码

protected void doGet(HttpServletRequest req, HttpServletResponse resp)
        throws ServletException, IOException {
    resp.setContentType("text/html");
    PrintWriter out = resp.getWriter();

    Cookie cookie = new Cookie("mycookie", "hi");
    resp.addCookie(cookie);

    cookie.setHttpOnly(true);
    boolean bol = cookie.isHttpOnly();
    out.println("<br>Cookie is Marked as HttpOnly = " + bol);
    Cookie[] cookies = req.getCookies();
    if (cookies != null) {
        for (int i = 0; i < cookies.length; i++) {

        out.println("<br/> From Cookies Array Name is: " 
            + cookies[i].getName());
        out.println("<br/> From Cookies Array Value is: "
            + cookies[i].getValue());
        out.println("<br/> From Cookies Array isHttpOnly: "
            + cookies[i].isHttpOnly());
        }
    }
    out.println("<br/> <br/>");

    cookie.setHttpOnly(false);
    boolean bol1 = cookie.isHttpOnly();
    out.println("<br>Cookie is Marked as HttpOnly = " + bol1);
    Cookie[] cookies1 = req.getCookies();
    if (cookies1 != null) {
        for (int i = 0; i < cookies1.length; i++) {
        out.println("<br/> From Cookies Array Name is: "
            + cookies[i].getName());
        out.println("<br/> From Cookies Array Value is: "
            + cookies[i].getValue());
        out.println("<br/> From Cookies Array isHttpOnly: "
            + cookies[i].isHttpOnly());
        }
    }
    out.close();
}

打印

    Cookie is Marked as HttpOnly = true
From Cookies Array Name is: mycookie
From Cookies Array Value is: hi
From Cookies Array isHttpOnly: false


Cookie is Marked as HttpOnly = false
From Cookies Array Name is: mycookie
From Cookies Array Value is: hi
From Cookies Array isHttpOnly: false 

请注意,我正在使用JBoss 7,并且在我添加的web.xml配置中,但我认为缺少了一些东西

<session-config>
        <cookie-config>
            <http-only>true</http-only>
        </cookie-config>
    </session-config>

Answer 1

浏览器就不会发出比的值,如仅Http,安全,最大生存周期,路径,等回其他cookie信息.浏览器仅发送与cookie名称关联的cookie值.

您可以通过跟踪webbrowser的开发人员工具集中的HTTP流量来自行查看.在Chrome/Firebug/IE9中按F12并打开"网络"或"网络"选项卡,然后浏览请求和响应标头.您将看到只有Set-Cookie响应头包含name = value附加cookie参数旁边,并且Cookie请求头只包含name = value.

别担心,在浏览器中会记住其他cookie参数.如果您不确定,可以通过创建具有相同名称和路径的新cookie来覆盖它.

也可以看看:

• RFC6265 - Cookie规范
• 维基百科 - HTTP cookie