一.HttpOnly

  • HttpOnly:控制Cookie的内容是否可以被JavaScript访问到。通过设置HttpOnly为true时防止XSS攻击防御手段之一
  • 默认HttpOnly为false,表示客户端可以通过js获取
  • 在项目中导入jquery.cookie.js库,使用jquery获取客户端Cookie内容
  • HTML代码如下
  1. <!DOCTYPE html>
  2. <html lang="en">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6.     <script src="/static/js/jquery-1.7.2.js"></script>
  7.     <script src="/static/js/jquery.cookie.js"></script>
  8.     <script type="text/javascript">
  9.         $(function () {
  10.             $("button").click(function () {
  11.                 var value = $.cookie("mykey")
  12.                 alert(value)
  13.             })
  14.         })
  15.     </script>
  16. </head>
  17. <body>
  18. <a href="setCookie">产生Cookie</a>
  19. <button>获取cookie</button>
  20. </body>
  21. </html>
  • 服务端代码如下
  1. package main
  3. import (
  4.     "net/http"
  5.     "html/template"
  6. )
  8. func welcome(w http.ResponseWriter, r *http.Request) {
  9.     t, _ := template.ParseFiles("view/index.html")
  10.     t.Execute(w, nil)
  11. }
  12. func setCookie(w http.ResponseWriter, r *http.Request) {
  13.     c := http.Cookie{Name: "mykey", Value: "myvalue", HttpOnly: false}
  14.     http.SetCookie(w, &c)
  15.     t, _ := template.ParseFiles("view/index.html")
  16.     t.Execute(w, nil)
  18. }
  20. func main() {
  21.     server := http.Server{Addr: ":8090"}
  22.     http.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
  23.     http.HandleFunc("/", welcome)
  24.     http.HandleFunc("/setCookie", setCookie)
  25.     server.ListenAndServe()
  26. }

二. Path

  • Path属性设置Cookie的访问范围
  • 默认为”/”表示当前项目下所有都可以访问
  • Path设置路径及子路径内容都可以访问
  • 首先先访问index.html,点击超链接产生cookie,在浏览器地址栏输入localhost:8090/abc/mypath后发现可以访问cookie
  • html代码没有变化,只需要修改服务器端代码如下
  1. package main
  3. import (
  4.     "net/http"
  5.     "html/template"
  6.     "fmt"
  7. )
  9. func welcome(w http.ResponseWriter, r *http.Request) {
  10.     t, _ := template.ParseFiles("view/index.html")
  11.     t.Execute(w, nil)
  12. }
  13. func setCookie(w http.ResponseWriter, r *http.Request) {
  14.     //验证httponly
  15.     //c := http.Cookie{Name: "mykey", Value: "myvalue", HttpOnly: false}
  16.     //验证path
  17.     c := http.Cookie{Name: "mykey", Value: "myvalue", Path: "/abc/"}
  18.     http.SetCookie(w, &c)
  19.     t, _ := template.ParseFiles("view/index.html")
  20.     t.Execute(w, nil)
  21. }
  23. //验证path属性是否生效的handler
  24. func mypath(w http.ResponseWriter, r *http.Request) {
  25.     fmt.Fprintln(w, r.Cookies())
  26. }
  28. func main() {
  29.     server := http.Server{Addr: ":8090"}
  30.     http.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
  31.     http.HandleFunc("/", welcome)
  32.     http.HandleFunc("/setCookie", setCookie)
  33.     //路径必须以/abc/开头
  34.     http.HandleFunc("/abc/mypath", mypath)
  35.     server.ListenAndServe()
  36. }

三.Expires

  • Cookie默认存活时间是浏览器不关闭,当浏览器关闭后,Cookie失效
  • 可以通过Expires设置具体什么时候过期,Cookie失效. 也可以通过MaxAge设置Cookie多长时间后实现
  • IE6,7,8和很多浏览器不支持MaxAge,建议使用Expires
  • Expires是time.Time类型,所以设置时需要明确设置过期时间
  • 修改服务器端代码如下.只需要修改创建Cookie的代码,其他位置不变
  1. package main
  3. import (
  4.     "net/http"
  5.     "html/template"
  6.     "fmt"
  7.     "time"
  8. )
  10. func welcome(w http.ResponseWriter, r *http.Request) {
  11.     t, _ := template.ParseFiles("view/index.html")
  12.     t.Execute(w, nil)
  13. }
  14. func setCookie(w http.ResponseWriter, r *http.Request) {
  15.     //验证httponly
  16.     //c := http.Cookie{Name: "mykey", Value: "myvalue", HttpOnly: false}
  17.     //验证path
  18.     //c := http.Cookie{Name: "mykey", Value: "myvalue", Path: "/abc/"}
  19.     //验证Expires
  20.     c := http.Cookie{Name: "mykey", Value: "myvalue", Expires: time.Date(2018, 1, 1, 1, 1, 1, 0, time.Local)}
  21.     http.SetCookie(w, &c)
  22.     t, _ := template.ParseFiles("view/index.html")
  23.     t.Execute(w, nil)
  24. }
  26. //验证path属性是否生效的handler
  27. func mypath(w http.ResponseWriter, r *http.Request) {
  28.     fmt.Fprintln(w, r.Cookies())
  29. }
  31. func main() {
  32.     server := http.Server{Addr: ":8090"}
  33.     http.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
  34.     http.HandleFunc("/", welcome)
  35.     http.HandleFunc("/setCookie", setCookie)
  36.     //路径必须以/abc/开头
  37.     http.HandleFunc("/abc/mypath", mypath)
  38.     server.ListenAndServe()
  39. }