[Spring] HttpOnly / Secure Cookie

HttpOnly 는 브라우저에 쿠키값 안뜨게 하는거    Secure Cookie 는 HTTPS 에서만 쿠키 전송되게 하는거

 

스프링에서 설정할 수도 있고

톰캣에서 설정할 수도 있는데

어디서 설정할지는..

 

application.properties 에서 설정

# 쿠키 보안 설정 server.servlet.session.cookie.http-only=true server.servlet.session.cookie.secure=true

application.yml 에서 설정

server:   servlet:     session:       cookie:         http-only: true

server:   servlet:     session:       cookie:         secure: true

자바 코드로 설정 (new Cookie 로 생성할때 설정)

import javax.servlet.http.Cookie; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class CookieUtil {     public static void addCookie(HttpServletResponse response, String name, String value, int maxAge, boolean httpOnly, boolean secure) {         Cookie cookie = new Cookie(name, value);         cookie.setMaxAge(maxAge);         cookie.setHttpOnly(httpOnly);         cookie.setSecure(secure);         response.addCookie(cookie);     }     public static Cookie getCookie(HttpServletRequest request, String name) {         Cookie[] cookies = request.getCookies();         if (cookies != null) {             for (Cookie cookie : cookies) {                 if (cookie.getName().equals(name)) {                     return cookie;                 }             }         }         return null;     } }

import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class YourServlet {     protected void doGet(HttpServletRequest request, HttpServletResponse response) {         // HTTPOnly 및 Secure 쿠키를 추가합니다.         CookieUtil.addCookie(response, "sessionId", "123456789", 3600, true, true);     } }

 

톰캣 server.xml 에 설정

<Context useHttpOnly="true">     <!-- 다른 설정들 -->     <CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"                     httpOnly="true" /> </Context>

<Context useHttpOnly="true">     <!-- 다른 설정들 -->     <CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"                     secure="true" /> </Context>