Java 在 spring 中自动向 JSESSIONID cookie 添加安全标志
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/39252924/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Add secure flag to JSESSIONID cookie in spring automatically
提问by ST-DDT
I have a tomcat application server that is behind a nginx. SSL terminates on the nginx. The Spring web-mvc application that is deployed on the tomcat should set the secure flag on the JSESSIONID. It would be cool if spring has some automatic detection for this so I don't get bothered during development because I don't have SSL there.
我有一个位于 nginx 后面的 tomcat 应用程序服务器。SSL 在 nginx 上终止。部署在 tomcat 上的 Spring web-mvc 应用程序应该在 JSESSIONID 上设置安全标志。如果 spring 对此有一些自动检测会很酷，这样我在开发过程中就不会受到打扰，因为那里没有 SSL。
Is there a way to tell spring to set the flag automatically?
有没有办法告诉 spring 自动设置标志？
I use JavaConfig to setup the application and use Maven to create a deployable war-file.
我使用 JavaConfig 来设置应用程序并使用 Maven 创建一个可部署的战争文件。
I have checked this already, but this looks somehow ugly and static: set 'secure' flag to JSESSION id cookie
我已经检查过了，但这看起来有点丑陋和静态： 将“安全”标志设置为 JSESSION id cookie
采纳答案by Stefan Isele - prefabware.com
When you use spring-session, e.g. to persist your session in reddis,
this is indeed done automatically. The cookie is than created by org.springframework.session.web.http.CookieHttpSessionStrategywhich in CookieHttpSessionStrategy#createSessionCookiechecks if the request comes via HTTPS and sets secure accordingly:
当您使用spring-session 时，例如将您的会话保存在 reddis 中，这确实是自动完成的。cookie 是由org.springframework.session.web.http.CookieHttpSessionStrategy它创建的，它CookieHttpSessionStrategy#createSessionCookie检查请求是否来自 HTTPS 并相应地设置安全：
sessionCookie.setSecure(request.isSecure());
If you do notuse spring-session, you can configure secure cookies using a ServletContextInitializer.
Use a application property, to set it to true/false depending on a profile.
如果您不使用 spring-session，则可以使用ServletContextInitializer. 使用应用程序属性，根据配置文件将其设置为 true/false。
@Bean
public ServletContextInitializer servletContextInitializer(@Value("${secure.cookie}") boolean secure) {
return new ServletContextInitializer() {
@Override
public void onStartup(ServletContext servletContext) throws ServletException {
servletContext.getSessionCookieConfig().setSecure(secure);
}
};
}
application.properties (used in dev when profile 'prod' is not active):
application.properties（在配置文件“prod”未激活时在开发中使用）：
secure.cookie=false
application-prod.properties (only used when profile 'prod' is active, overwrites value in application.properties):
application-prod.properties（仅在配置文件“prod”处于活动状态时使用，覆盖 application.properties 中的值）：
secure.cookie=false
start your application on the prod server with :
使用以下命令在 prod 服务器上启动您的应用程序：
--spring.profiles.active=prod
Sounds like some effort, if you have not worked with profiles so far, but you will most likely need a profile for prod environment anyway, so its really worth it.
听起来有些努力，如果您到目前为止还没有使用过配置文件，但无论如何您很可能需要一个 prod 环境的配置文件，所以它真的很值得。
回答by AYRM1112013
in your application.yml just add
在您的 application.yml 中添加
server:
session:
cookie:
secure: true
回答by Jonask
If you are using Spring Boot, there is a simple solution for it. Just set the following property in your application.properties:
如果您使用的是 Spring Boot，有一个简单的解决方案。只需在您的 中设置以下属性application.properties：
server.servlet.session.cookie.secure=true
Source: Spring docs - Appendix A. Common application properties
If you have some environment with HTTPS and some without it, you will need to set it to false in profiles without HTTPS. Otherwise the Secure cookie is ignored.
如果您有一些使用 HTTPS 的环境而一些没有使用它，则需要在没有 HTTPS 的配置文件中将其设置为 false。否则，安全 cookie 将被忽略。
回答by Khoa Phung
Add another option
添加另一个选项
You can use a ServletContextInitializer to set secure cookie and http only flag
您可以使用 ServletContextInitializer 来设置安全 cookie 和 http only 标志
@Bean
public ServletContextInitializer servletContextInitializer() {
return new ServletContextInitializer() {
@Override
public void onStartup(ServletContext servletContext) throws ServletException {
servletContext.setSessionTrackingModes(Collections.singleton(SessionTrackingMode.COOKIE));
SessionCookieConfig sessionCookieConfig = servletContext.getSessionCookieConfig();
sessionCookieConfig.setHttpOnly(true);
sessionCookieConfig.setSecure(true);
}
};
}
