网站的Cookie管理除了限定Domain增强安全性之外，.net 2.0新增一个Cookie属性HttpOnly。很棒！
在做一个cookie功能时用到了Cookie的一个属性HttpOnly
Code
<!-- {cps..10}-->
HttpCookiea
=
new
HttpCookie(
"
TestName
"
,
"
TestValue
"
);
a.Domain
=
"
.test.com
"
;
a.HttpOnly
=
true
;
Response.Cookies.Add(a);
原以为这样后，客户端应该无法访问该Cookie了！
结果，如图
感觉比较诡异，于是再查MSDN
得知原来有两个cookie类。System.Web.HttpCookie 类 和 System.Net.Cookie 类
注意命名空间不同。
两个类的说明分别如下：
Cookie 类提供一组用于管理 Cookie 的属性和方法。无法继承此类。命名空间:
System.Net
HttpCookie 类
提供创建和操作各 HTTP Cookie 的类型安全方法。
命名空间:
System.Web
两个类都有HttpOnly属性，分别说明如下：
Cookie.HttpOnly 属性注意：此属性在 .NET Framework 2.0 版中是新增的。确定页脚本或其他活动内容是否可访问此 Cookie。
HttpCookie.HttpOnly 属性注意：此属性在 .NET Framework 2.0 版中是新增的。
获取或设置一个值，该值指定 Cookie 是否可通过客户端脚本访问。
问题来了，关键的理解点在于通过什么东东来访问。
不太理解微软机器翻译的“页脚本或其他活动内容
”究竟指什么玩意？
于是做测试，建立一个Web Application,
在TestCookie.aspx页面，的Page_Load事件中加入
Code
<!-- {cps..16}-->//
Response.Cookies.Clear();
//
System.Web.HttpCookie;
HttpCookiea
=
new
HttpCookie(
"
TestName
"
,
"
TestValue
"
);
//
a.Domain=Request.ServerVariables["HTTP_HOST"];
a.HttpOnly
=
false
;
Response.Cookies.Add(a);
HttpCookieb
=
new
HttpCookie(
"
TestB
"
,
"
TestB
"
);
b.HttpOnly
=
true
;
//
b.Domain=Request.ServerVariables["HTTP_HOST"];
Response.Cookies.Add(b);
Response.Write(
"
System.Web.HttpCookie;------------<br/>
"
);
for
(
int
i
=
0
;i
<
Request.Cookies.Count;i
++
)
{
HttpCookiecook
=
Request.Cookies[i];
Response.Write(
"
<Br/>
"
);
Response.Write(
"
Cookie:
"
);
Response.Write(
string
.Format(
"
{0}={1}
"
,cook.Name,cook.Value)
+
"
<Br/>
"
);
//
Response.Write(string.Format("Domain:{0}",cook.Domain)+"<Br/>");
Response.Write(
string
.Format(
"
Path:{0}
"
,cook.Path)
+
"
<Br/>
"
);
Response.Write(
string
.Format(
"
Secure:{0}
"
,cook.Secure)
+
"
<Br/>
"
);
Response.Write(
string
.Format(
"
HttpOnly:{0}
"
,cook.HttpOnly)
+
"
<Br/>
"
);
}
//
//
System.Net.CookieContainerCookieContainerObject=newSystem.Net.CookieContainer();
System.Net.CookieCollectionCookieCollectionObject
=
new
System.Net.CookieCollection();
System.Net.Cookiea2
=
new
System.Net.Cookie(
"
TestName2
"
,
"
TestValue2
"
);
a2.HttpOnly
=
false
;
a2.Domain
=
Request.ServerVariables[
"
HTTP_HOST
"
];
//
CookieContainerObject.Add(a2);
CookieCollectionObject.Add(a2);
System.Net.Cookieb2
=
new
System.Net.Cookie(
"
TestB2
"
,
"
TestB2
"
);
b2.HttpOnly
=
true
;
b2.Domain
=
Request.ServerVariables[
"
HTTP_HOST
"
];
//
CookieContainerObject.Add(b2);
CookieCollectionObject.Add(b2);
Response.Write(
"
<Br/>
"
);
Response.Write(
"
System.Net.Cookie;*********************<br/>
"
);
foreach
(System.Net.Cookieck
in
CookieCollectionObject)
{
Response.Write(
"
<Br/>
"
);
Response.Write(
"
Cookie:
"
);
Response.Write(
string
.Format(
"
{0}={1}
"
,ck.Name,ck.Value)
+
"
<Br/>
"
);
//
Response.Write(string.Format("Domain:{0}",ck.Domain)+"<Br/>");
Response.Write(
string
.Format(
"
Path:{0}
"
,ck.Path)
+
"
<Br/>
"
);
Response.Write(
string
.Format(
"
Secure:{0}
"
,ck.Secure)
+
"
<Br/>
"
);
Response.Write(
string
.Format(
"
HttpOnly:{0}
"
,ck.HttpOnly)
+
"
<Br/>
"
);
}
该段代码的功能主要是测试能否正确读写Cookie
结果如下：
Code
<!-- {cps..12}-->System.Web.HttpCookie;------------
Cookie:TestName=TestValue
Domain:10.103.33.102:2888
Path:/
Secure:False
HttpOnly:False
Cookie:TestB=TestB
Domain:10.103.33.102:2888
Path:/
Secure:False
HttpOnly:True
System.Net.Cookie;*********************
Cookie:TestName2=TestValue2
Domain:10.103.33.102:2888
Path:
Secure:False
HttpOnly:False
Cookie:TestB2=TestB2
Domain:10.103.33.102:2888
Path:
Secure:False
HttpOnly:True
再建一ConSole Application,
看看能否获取并修改该页面的Cookie
代码如下：
Code
<!-- {cps..13}-->string
surl
=
"
http://10.103.33.102:2888/TestCookie.aspx
"
;
HttpWebRequestWebRequestObject
=
(HttpWebRequest)WebRequest.Create(surl);
WebRequestObject.CookieContainer
=
new
CookieContainer();
HttpWebResponseWebResponseObject
=
(HttpWebResponse)WebRequestObject.GetResponse();
System.Net.CookieCollectionCookieCollectionObject
=
new
System.Net.CookieCollection();
//
Printthepropertiesofeachcookie.
foreach
(Cookiecook
in
WebResponseObject.Cookies)
{
Console.WriteLine(
"
-----------------------System.Web.HttpCookie--------------------------
"
);
Console.WriteLine(
"
Cookie:
"
);
Console.WriteLine(
"
{0}={1}
"
,cook.Name,cook.Value);
Console.WriteLine(
"
Domain:{0}
"
,cook.Domain);
Console.WriteLine(
"
Path:{0}
"
,cook.Path);
Console.WriteLine(
"
Port:{0}
"
,cook.Port);
Console.WriteLine(
"
Secure:{0}
"
,cook.Secure);
Console.WriteLine(
"
HttpOnly:{0}
"
,cook.HttpOnly);
/**/
//////
Showthestringrepresentationofthecookie.
///
/Console.WriteLine("String:{0}",cook.ToString());
System.Net.Cookiec
=
new
System.Net.Cookie();
c.Name
=
cook.Name;
c.Path
=
cook.Path;
c.HttpOnly
=
cook.HttpOnly;
c.Domain
=
cook.Domain;
c.Expires
=
cook.Expires;
c.Value
=
cook.Value;
CookieCollectionObject.Add(cook);
}
foreach
(System.Net.Cookieck
in
CookieCollectionObject)
{
Console.WriteLine(
"
----------------------System.Net.Cookie-------------------------------------
"
);
Console.WriteLine(
"
Cookie:
"
);
Console.WriteLine(
"
{0}={1}
"
,ck.Name,ck.Value);
Console.WriteLine(
"
Domain:{0}
"
,ck.Domain);
Console.WriteLine(
"
Path:{0}
"
,ck.Path);
Console.WriteLine(
"
Port:{0}
"
,ck.Port);
Console.WriteLine(
"
Secure:{0}
"
,ck.Secure);
Console.WriteLine(
"
HttpOnly:{0}
"
,ck.HttpOnly);
System.Web.HttpCookiec
=
new
System.Web.HttpCookie(ck.Name);
c.Name
=
ck.Name;
c.Path
=
ck.Path;
c.HttpOnly
=
ck.HttpOnly;
c.Domain
=
ck.Domain;
c.Expires
=
DateTime.Now.AddDays(
1
);
c.Value
=
ck.Value
+
"
--Update
"
;
WebResponseObject.Cookies.Add(ck);
}
foreach
(Cookiecook
in
WebResponseObject.Cookies)
{
Console.WriteLine(
"
-----------------UpdateedSystem.Web.HttpCookie--------------------------
"
);
Console.WriteLine(
"
Cookie:
"
);
Console.WriteLine(
"
{0}={1}
"
,cook.Name,cook.Value);
Console.WriteLine(
"
Domain:{0}
"
,cook.Domain);
Console.WriteLine(
"
Path:{0}
"
,cook.Path);
Console.WriteLine(
"
Port:{0}
"
,cook.Port);
Console.WriteLine(
"
Secure:{0}
"
,cook.Secure);
Console.WriteLine(
"
HttpOnly:{0}
"
,cook.HttpOnly);
}
运行结果
Code
<!-- {cps..14}-->-----------------------System.Web.HttpCookie--------------------------
Cookie:
TestName=TestValue
Domain:10.103.33.102
Path:/
Port:
Secure:False
HttpOnly:False
-----------------------System.Web.HttpCookie--------------------------
Cookie:
TestB=TestB
Domain:10.103.33.102
Path:/
Port:
Secure:False
HttpOnly:True
----------------------System.Net.Cookie-------------------------------------
Cookie:
TestName=TestValue
Domain:10.103.33.102
Path:/
Port:
Secure:False
HttpOnly:False
----------------------System.Net.Cookie-------------------------------------
Cookie:
TestB=TestB
Domain:10.103.33.102
Path:/
Port:
Secure:False
HttpOnly:True
-----------------UpdateedSystem.Web.HttpCookie--------------------------
Cookie:
TestName=TestValue
Domain:10.103.33.102
Path:/
Port:
Secure:False
HttpOnly:False
-----------------UpdateedSystem.Web.HttpCookie--------------------------
Cookie:
TestB=TestB
Domain:10.103.33.102
Path:/
Port:
Secure:False
HttpOnly:True
请注意， c.Value = ck.Value+"--Update";这句在修改Cookie.value后并没有成功写入该页面的Cookie集合中，换言之，一个未知的客户端应用程序并没有通过读取一个页面的Cookie并修改再写入该页面的Cookie集合。
我的理解是：
1、System.Web.httpCookie主要是服务器端应用。
System.Net.Cookie主要是客户端程序应用，后者可以读取前者的Cookie属性和值，而不能修改服务器定义的Cookie。
2、System.Web.httpCookie.HttpOnly=true后，客户端脚本无法访问该Cookie,但其他程序仍然可以访问。
System.Net.Cookie.HttpOnly=true后，困其是客户端程序，故有更多的限制，不允许”页面脚本及其他程序“访问
该Cookie, 只有创建它的应用程序可以访问。并且在特定的Domain下。
值得注意的是：HttpOnly属性仅对IE 6 SP1以上的版本才有效，在FireFox3.01下也可以！但对于IE5.x的机器，可能就****
欢迎大伙指正。
