![Cookie 不包含 secure 和 HTTPOnly 属性](https://linux22.com/image/724713/Cookie%20%E4%B8%8D%E5%8C%85%E5%90%AB%20secure%20%E5%92%8C%20HTTPOnly%20%E5%B1%9E%E6%80%A7.png)
在正在开发的网站上运行 Qualys 漏洞扫描时,我发现了以下漏洞:
Cookie Does Not Contain The "HTTPOnly" Attribute
Cookie Does Not Contain The "secure" Attribute
ExpressJS
我的应用程序在和Web 服务器NodeJS
中运行nginx
。我正在使用 express-session 和 csurf token。我已经将HTTPOnly
和secure
标志都设置为 true。配置如下:
app.use(bodyParser.json({limit: '50mb'}));
app.use(bodyParser.urlencoded({extended: false, limit: '50mb'}));
app.use(cookieParser());
app.use(express.static(path.join(__dirname, "/../public")));
app.enable("trust proxy");
app.use(expressSession({
store: new MongoStore({
url: `session_db`
}),
secret: `session_secret`,
resave: true,
saveUninitialized: true,
proxy: true,
rolling: true,
cookie: {
secure: true,
httpOnly: false,
maxAge: (72 * 60 * 60 * 1000)
},
unset: "destroy"
}));
app.use(passport.initialize());
app.use(passport.session());
app.use(flash());
app.use("/api", api);
app.use( csrf({
cookie: {
secure: true,
httpOnly: true
}
}));//csrf
我的 nginx 配置是:
location / {
proxy_pass http://nodejs;
proxy_set_header Host $host ;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto https;
proxy_cookie_path / "/; HTTPOnly; Secure";
}
HTTPOnly
并且secure
浏览器 cookie 部分中的两个标志都被勾选。但是当我扫描它时,它显示了上面提到的漏洞。
有人能帮我吗?
等待你的帮助朋友