检查Javascript中是否存在httponly cookie [英] Check if httponly cookie exists in Javascript

问题描述

因为问题说，如果你是一个HttpOnly，你能否知道一个cookie是否存在于Javascript中？我不需要访问它里面的信息，只是知道它有一个。

有关情况的一点更多的信息是，最初有一个Web服务器使用cookie作为身份验证令牌，并将其设置为httponly，因为它未被客户端使用，因此将其添加到安全性。

但是现在有一个更改需要的地方，客户端需要知道它是否有cookie（因为网站可以工作没有用户登录，但如果他们登录（auth cookie会存在），网站需要显示某些东西，隐藏别人。 / p>

Web服务器上还有其他安全预防措施，因此在客户端具有不正确的auth cookie的情况下没有危害，但是网站看起来像

解决方案

否，请参阅Rob的评论。

p>

查看这个内容，您可能已经看到了 - http ：//en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

无法通过非HTTP访问HttpOnly Cookie方法，例如
通过JavaScript调用（例如，引用document.cookie）...

编辑：已删除 undefined 回应，我写了一个您可能未使用的指令码：）

As the question says can you find out if a cookie exists within Javascript if it is a HttpOnly? I don't need to access the information inside of it, just know it has one.

A little more information on the situation is that there was originally a web server which used a cookie as an authentication token, and it was set to httponly as it was not used by the client so it added to the security.

However now there is a change needed where the client needs to know if it has the cookie (as the site can work without the user being logged in, but if they are logged in (the auth cookie would exist) the site needs to display certain things and hide others.

There are other security precautions in place on the web server so there is no harm in the scenario where the client has an incorrect auth cookie, but the site makes it look like they are logged in, as it would delete the cookie and reject the user.

解决方案

No. And see Rob's comments below.

See this, which you probably already saw - http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

An HttpOnly cookie is not accessible via non-HTTP methods, such as calls via JavaScript (e.g., referencing "document.cookie")...

Edit: Removed undefined response, I wrote a script that you may not be using :)

这篇关于检查Javascript中是否存在httponly cookie的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！