文档章节

httpOnly Cookies using web.xml servlet 3.0 in JBos

商者
 商者
发布于 2016/07/14 09:21
字数 1349
阅读 81
收藏 1

Securing our Applications is one of the most important task while moving to the production environment. Securing HttpSession is one of them. In this demonstration we will see how to use the HttpOnly cookies in “web.xml” using the tag “httpOnly”, Yes, this is a new feature added as part of Servlet3.0 Specification that we cna specify the httpOnly cookies directly using web.xml file.

The HttpOnly cookie is supported by most modern browsers. On a supported browser, an HttpOnly session cookie will be used only when transmitting HTTP (or HTTPS) requests, thus restricting access from other, non-HTTP APIs (such as JavaScript). This restriction mitigates but does not eliminate the threat of session cookie theft via Cross-site scripting. It means on client side the cookies can not be accessed using java script or some other scripting utilities. This feature applies only to session-management cookies, and not other browser cookies.

Earlier in JBoss AS6 we had a feature called as “context.xml” using which we could define the cookies as “httpOnly” by either editing the “${PROFILE}/deploy/jbossweb.sar/context.sar/context.xml” file or by creating “conntext.xml” file inside our application “${YOUR_APP}/WEB-INF/context.xml” file as following:

<Context cookies="true" crossContext="true" useHttpOnly="true">
   <SessionCookie httpOnly="true"/> 
</Context>

In this demonstration we will be using JBoss AS7 ( jboss-as-7.1.0.Beta1 ) which can be downloaded from the following link: http://www.jboss.org/jbossas/downloads
And we will see how we can specify httpOnly cookies using the standard web descriptor “web.xml” file using servlet 3.0 specification.

Step1). Create a Directory somewhere inside your file system where we can create our web application. Suppose i am creating a directory as “/home/userone/httpOnlyDemo” and the create a subdirectory with name “src” inside “/home/userone/httpOnlyDemo”

Step2). Now place the following kind of “web.xml” inside the “/home/userone/httpOnlyDemo/src” directory.

<?xml version="1.0"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://java.sun.com/xml/ns/javaee web-app_3_0.xsd"
      version="3.0">
    
      <!-- Make sure that your web.xml is pointing the version="3.0" as above -->
      <session-config>
        <cookie-config>
           <http-only>true</http-only>
        </cookie-config>
      </session-config>
    
</web-app>

NOTE: The only thing here you need to kiip in mind that you are using the “web-app_3_0.xsd” in your “web.mxl” file pointing to version=”3.0″.

Step3). Now we will write a simple JSP Page in order to display the JSESSIONID cookie value in the browser with the help of Java Script. (Ideally the code should not be able to display the JSESSIONID cookie value with the help of java script here because we have marked out Cookie as “httpOnly”…so you can try both ways by enabling and disabling the http-only tag inside your web.xml to see what different you see while hitting the JSP Page.)

<%
   System.out.println("nt index.jsp is called...request="+request);
%>
<html>
    <head>
        <title>Hi HttpOnly</title>
        <script type="text/javascript">
          function ReadCookie(cookieName) 
           {
              var theCookie=""+document.cookie;
              var ind=theCookie.indexOf(cookieName);
              if (ind==-1 || cookieName=="") return ""; 
                 var ind1=theCookie.indexOf(';',ind);
              if (ind1==-1) ind1=theCookie.length; 
                 return unescape(theCookie.substring(ind+cookieName.length+1,ind1));
           }
       </script>
    </head>
    <body bgcolor="maroon" text="white">
            <center>
            <h1>Hello CookieDemo "HttpOnly" !!!

	<form name="getCookie">
	    <table border=0 cellpadding=3 cellspacing=3>
	     <tr><td>Cookie Name:&nbsp;</td><td><input name=t1 type=text size=20 value="JSESSIONID"></td></tr>
             <tr><td><input name=b1 type=button value="Read Cookie Value" onClick="this.form.t2.value=ReadCookie(this.form.t1.value)">&nbsp;</td>    <td><input name=t2 type=text size=20 value=""></td></tr>
           </table>
        </form>
       <b>NOTE: when you click on this button you should not be able to see the JSESSIONID cookie value in the textField if the http-only cookie is enabled.</b>
   </center>
    </body>
</html>

Step4). Now we will write a simple ant “build.xml” file in order to build and deploy our web application on JBoss AS7. So write the following “build.xml” file inside “/home/userone/httpOnlyDemo” as following:

<project name="httpOnlyCookieDemo" default="deploy">
<property name="jboss.home" value="/home/userone/jboss-as-7.1.0.Beta1" />
<property name="jboss.module.dir" value="${jboss.home}/modules" />
<property name="basedir" value="." />
<property name="tmp.dir" value="tmp" />
<property name="output.dir" value="build" />
<property name="src.dir" value="src" />
<property name="war.name" value="httpOnlyDemo.war" />

        <path id="jboss.classpath">
           <fileset dir="${jboss.module.dir}">
              <include name="**/*.jar"/>
           </fileset>  
        </path>

        <target name="init">
           <delete dir="${output.dir}" />
           <mkdir dir="${output.dir}" />
           <delete dir="${tmp.dir}" />
           <mkdir dir="${tmp.dir}" />
        </target>
	 
        <target name="build" depends="init">
           <mkdir dir="${tmp.dir}/WEB-INF"/>
           <copy file="${src.dir}/index.jsp" tofile="${tmp.dir}/index.jsp"/>
           <copy todir="${tmp.dir}/WEB-INF">
                <fileset dir="${src.dir}/">
                  <include name="web.xml"/> 
                </fileset>
           </copy>          
           <jar jarfile="${tmp.dir}/${war.name}" basedir="${tmp.dir}" compress="true" />
           <copy file="${tmp.dir}/${war.name}" tofile="${output.dir}/${war.name}"/>
           <delete includeEmptyDirs="true">
              <fileset dir="${tmp.dir}"/>
           </delete> 
        </target>

        <target name="deploy" depends="build">
            <echo message="*******************  Deploying the WAR file ${war.name} *********************" />  
            <echo message="********** ${output.dir}/${war.name} to ${jboss.home}/standalone/deployments **********" />  
            <copy todir="${jboss.home}/standalone/deployments/">
                <fileset dir="${output.dir}/">
                  <include name="${war.name}"/> 
                </fileset>
            </copy>
            <echo message="*******************  Deployed Successfully   *********************" />  
        </target>
</project>

NOTE: The only change in the above file you need to do is to change the “jboss.home” directory path in the second line of the above script is to point to your own JBoss AS7 directory home directory.

Step5). Now before running your ANT script to build and deploy the above webapplication you should have the ANT as well as JAVA set in the $PATH variable of the Shell / command prompt as following:

1

2

3

4

5

For Unix Based OS:

export PATH=/home/userone/jdk1.6.0_21/bin:/home/userone/apache-ant-1.8.2/bin:$PATH

 

For Windows Based OS:

set PATH=C:/jdk1.6.0_21/bin;C:/apache-ant-1.8.2/bin;%PATH%

Step6). Now run the ant file from the directory where you have placed the “build.xml” file as following:

[userone@localhost httpOnlyDemo]$ ant
Buildfile: /home/userone/httpOnlyDemo/build.xml

init:
   [delete] Deleting directory /home/userone/httpOnlyDemo/build
    [mkdir] Created dir: /home/userone/httpOnlyDemo/build
    [mkdir] Created dir: /home/userone/httpOnlyDemo/tmp

build:
    [mkdir] Created dir: /home/userone/httpOnlyDemo/tmp/WEB-INF
     [copy] Copying 1 file to /home/userone/httpOnlyDemo/tmp
     [copy] Copying 1 file to /home/userone/httpOnlyDemo/tmp/WEB-INF
      [jar] Building jar: /home/userone/httpOnlyDemo/tmp/httpOnlyDemo.war
     [copy] Copying 1 file to /home/userone/httpOnlyDemo/build

deploy:
     [echo] *******************  Deploying the WAR file httpOnlyDemo.war *********************
     [echo] ********** build/httpOnlyDemo.war to /home/userone/jboss-as-7.1.0.Beta1/standalone/deployments **********
     [copy] Copying 1 file to /home/userone/jboss-as-7.1.0.Beta1/standalone/deployments
     [echo] *******************  Deployed Successfully   *********************

BUILD SUCCESSFUL
Total time: 0 seconds

Step7). Now access the application like following: “http://localhost:8080/httpOnlyDemo/index.jsp” and then see whether you are able to see the JSESSIONID value or not? Also try removing the http-only tag from your web.xml file and then redeploy the application and then again try to access the application to check whether you are able to see the JSESSIONID cookie value or not .

Some more useful tags from Servlet 3.0 Specifications

You can get more details on these tags from the following link:http://java.sun.com/xml/ns/javaee/web-common_3_0.xsd
Also we can use some more useful tags in order to secure our WebAppications with the help of servlet3.0 tags present inside “web.xml” file like following

secure cookie: A secure cookie is only used when a browser is visiting a server via HTTPS, ensuring that the cookie is always encrypted when transmitting from client to server. This makes the cookie less likely to be exposed to cookie theft via eavesdropping.

<session-config>
  <cookie-config>
    <secure>true</secure>
  </cookie-config>
</session-config>

tracking-mode cookie: tracking-mode element in the Servlet 3.0 specification allows you to define whether the JSESSIONID should be stored in a cookie or in a URL parameter. If the session id is stored in a URL parameter it could be inadvertently saved in a number of locations including the browser history, proxy server logs, referrer logs, web logs, etc. Accidental disclosure of the session id makes the application more vulnerable to session hijacking attacks. Instead, make sure the JSESSIONID is stored in a cookie if tracking-mode is set to COOKIE. The valid values for tracing-mode are COOKIE/SSL/URL

<session-config>
  <cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
  </cookie-config>
</session-config>

.
.
Thanks
MiddlewareMagic Team

本文转载自:http://middlewaremagic.com/jboss/?p=1041

共有 人打赏支持
商者

商者

粉丝 42
博文 142
码字总数 43255
作品 0
海淀
架构师
私信 提问
Servlet 3.0 介绍

下载 Servlet 3.0 规范 Java servlets 是一项被普遍接受的技术,用于构建基于 web 应用程序的动态内容;Servlet 3.0 规范早期草案版本的发行让该技术在特性和应用程序接口(Application Progra...

红薯
2010/05/27
1K
4
Servlet 3.0 新特性详解

简介: Servlet 是 Java EE 规范体系的重要组成部分,也是 Java 开发人员必须具备的基础技能,Servlet 3.0 是 Servlet 规范的最新版本。本文主要介绍了 Servlet 3.0 引入的若干重要新特性,包...

红薯
2010/04/23
1K
3
Servlet 3.0 特性详解

Servlet 是 Java EE 规范体系的重要组成部分,也是 Java 开发人员必须具备的基础技能,本文主要介绍了 Servlet 3.0 引入的若干重要新特性,包括异步处理、新增的注解支持、可插性支持等等,为...

那位先生
2015/06/12
0
0
Servlet 3.0 新特性

Servlet 3.0 作为 Java EE 6 规范体系中一员,随着 Java EE 6 规范一起发布。该版本在前一版本(Servlet 2.5)的基础上提供了若干新特性用于简化 Web 应用的开发和部署。其中有几项特性的引入...

壹炮倾城
2013/06/13
0
1
spring mvc 访问静态文件的问题!请指教!

这是web—xml的配置 TalentCloud index.jsp default *.js default *.css default *.png default *.jpg default *.gif spring3mvc org.springframework.web.servlet.DispatcherServlet 1 spri......

Ales_小溪
2013/07/22
805
1

没有更多内容

加载失败,请刷新页面

加载更多

oracle dg备库重建redolog:ora-00313,ora-00312

trace文件: Errors in file /crbank/dbs/app/product/diag/rdbms/rdbs/dbs/trace/dbs_mrp0_24445130.trc: ORA-00313: open failed for members of log group 8 of thread 1 ORA-00312: onl......

hnairdb
4分钟前
0
0
深入分析Java I/O的工作机制 (一)

1.Java的I/O类库的基本架构 先说一下什么是类库:可以说是类的集合,类库包括接口、抽象类、具体类等。 I/O是机器获取和交互信息的主要渠道。 java在I/O上也一直在做持续的优化,在1.4版开始...

java菜分享
13分钟前
0
0
第一篇:centos7下svn的安装与卸载

第一篇:centos7下svn的安装与卸载 2017年11月29日 00:10:53 独家记忆ly 阅读数:6108 这是我的第一篇博客,本人也是刚开始学习linux,如果有不对的地方,希望各位大神纠正指点。谢谢~~ 一、...

linjin200
13分钟前
0
0
el-tree 动态图标

举个栗子: https://jsfiddle.net/taadis/x9crjsum/

taadis
22分钟前
0
0
对Docker了解多少?10分钟带你从入门操作到实战上手

Docker简述 Docker是一种OS虚拟化技术,是一个开源的应用容器引擎。它可以让开发者将应用打包到一个可移植的容器中,并且该容器可以运行在几乎所有linux系统中(Windows10目前也原生支持,W...

别打我会飞
46分钟前
4
0

没有更多内容

加载失败,请刷新页面

加载更多

返回顶部
顶部