检查 JavaScript 中是否存在 httponly cookie [英] Check if httponly cookie exists in Javascript

问题描述

正如问题所说，如果 cookie 是 HttpOnly，你能找出 Javascript 中是否存在 cookie 吗?我不需要访问它里面的信息，只要知道它有一个.

As the question says can you find out if a cookie exists within Javascript if it is a HttpOnly? I don't need to access the information inside of it, just know it has one.

关于这种情况的更多信息是，最初有一个Web服务器使用cookie作为身份验证令牌，并且由于客户端不使用它而将其设置为httponly，因此添加了安全性.

A little more information on the situation is that there was originally a web server which used a cookie as an authentication token, and it was set to httponly as it was not used by the client so it added to the security.

但是现在需要进行更改，其中客户端需要知道它是否具有 cookie(因为该站点可以在没有用户登录的情况下工作，但是如果他们已登录(auth cookie 将存在)，则站点需要显示某些东西并隐藏其他东西.

However now there is a change needed where the client needs to know if it has the cookie (as the site can work without the user being logged in, but if they are logged in (the auth cookie would exist) the site needs to display certain things and hide others.

Web 服务器上还有其他安全预防措施，因此在客户端具有不正确的 auth cookie 的情况下不会造成危害，但该站点使其看起来像是已登录，因为它会删除 cookie 并拒绝用户.

There are other security precautions in place on the web server so there is no harm in the scenario where the client has an incorrect auth cookie, but the site makes it look like they are logged in, as it would delete the cookie and reject the user.

推荐答案

没有.并在下面查看 Rob 的评论.

No. And see Rob's comments below.

看到这个，你可能已经看到了 - http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

See this, which you probably already saw - http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

HttpOnly cookie 不能通过非 HTTP 方法访问，例如通过 JavaScript 调用(例如，引用document.cookie")...

An HttpOnly cookie is not accessible via non-HTTP methods, such as calls via JavaScript (e.g., referencing "document.cookie")...

删除了 undefined 响应，我写了一个你可能没有使用的脚本 :)

Removed undefined response, I wrote a script that you may not be using :)

这篇关于检查 JavaScript 中是否存在 httponly cookie的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！