跳到主要內容

設定 Cookie 時使用 HttpOnly 特性減低網站安全風險(XSS)

http://blog.miniasp.com/post/2009/11/26/Using-HttpOnly-flag-to-avoid-XSS-attack.aspx

asp寫法
Response.AddHeader "Set-Cookie", "CookieName=CookieValue; path=/; HttpOnly"

也可以加上domain, expires，譬如
Response.AddHeader "Set-Cookie", "test=123; domain=localhost; expires="&GetGMT(now()+1)&"; path=/; HttpOnly"

function GetGMT(od)
  'GMT格式： Tue, 23 Dec 2014 23:19:08 GMT
  od=dateAdd("h",8,od)
  aWeek=Array("","Sun","Mon","Tue","Wed","Thu","Fri","Sat")
  aMonth=Array("","Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec")
  nd=aWeek(weekday(od)) &", "& day(od) &" "& aMonth(month(od)) &" "& year(od) &" "& right("00"&hour(od),2)&":"&right("00"&minute(od),2)&":"&right("00"&second(od),2)&" GMT"
  GetGMT = nd
end function

留言

張貼留言

這個網誌中的熱門文章

How to install iCloud on Windows Server

現象： iCloud 無法運行或發生錯誤 原因： 新版的 iCloud 只能在 Windows 7 或 8 運行 修改步驟： 1. 安裝  7-zip ，如果你還沒有安裝 2. 安裝 Orca , 這是 Microsoft 提供的 MSI 編輯器 3. 下載   iCloud control panel installer ，如果你還沒有下載 4. 用 7-zip 解壓縮  iCloudSetup.exe 5. 開啟 Orca，開啟 iCloud64.msi，假設你系統是64bit 6. 找到 LaunchCondition table 7. 將 LaunchCondition table 刪除 8. 存檔，關閉 Orca 9. iCloud64.msi 按右鍵，點安裝
張貼留言
閱讀完整內容

jQuery: Radio Button, Checkbox and Selecter

Trigger the event: $("input[name='lom']").change(function(){ // Do something interesting here }); Radio Button: To get the selected value: var v=$('input[name=Sex]:checked').val(); if( typeof(v) == 'undefined'){ //there's no button selected } To select radio button from value: $("input[name=Sex][value='2']").attr('checked',true); To select radio button from index: $('input[name=Sex]')[1].checked = true; Checkbox: To see whether checkbox is checked: $('#chk').is(':checked'); To set checkbox: $("#chk1").attr("checked",''); $("#chk2").attr("checked",true); Selecter: To get the selected value: $('#selectList').val(); $('#selectList :selected').text(); To add a new option: $('#selectList').addOption(value,text);
張貼留言
閱讀完整內容

Ajax pageview of Google Analytics

first, to be sure the google analytics api is new version, such as var _gaq = _gaq || []; _gaq.push(['_setAccount', 'UA-xxxxxx-x']); _gaq.push(['_trackPageview']); (function() { var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true; ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s); })(); the way 1. use ajaxSetup for all calls to $.ajax. notice 1: ajaxSetup is better writeen within $( document ).ready() to be sure the google analytics api is loaded. notice 2: the opts.url is the ajax url you write, to record corect pageview, the best way is use fullpath, such as '/folder_name/filename.php' $(function () { $.ajaxSetup({ beforeSend: function (xhr, opts) { //avoid cache of the iOS6 Safa...
張貼留言
閱讀完整內容