以下内容适合IE6.0浏览器
1. Cookie用来保存信息,是Session,Asp.net Form认证的基础
2.Cookie 有 Name, Value,Domain, Expires,Path,HttpOnly等属性
3. Cookie 按存在时间分临时Cookie,跟持久Cookie. 临时Cookie没指明Expires属性,因此不会在IE的临时文件夹中生成相应cookie文件,而持久cookie是指设置了expires属性,(具体时间可以是比当前时间多1秒或者2秒...,不一定是很长的时间),这样的cookie会在IE临时文件夹下生成一个cookie文件,当然这个cookie文件会在expires到期后自动删除掉.
4. IE6.0支持Cookie HttpOnly 属性,指定了HttpOnly属性的cookie 不允许客户端脚本访问如: URL(地址栏)中输入javascript:alert(document.cookie) 将显示含HttpOnly属性的cookie,当然着也意味着javascript无法生成含httpOnly的cookie, 这样可以在一定程度上避免跨站点脚本攻击.Asp.net2.0以及以后版本中的HttpCookie类可以直接设置HttpOnly属性,不过Asp中你需要类似下面的处理:
-------代码--------------
<%'**************************************************'ASP 中输出httponly cookie IE6.0以上浏览器支持'WDFrog'2009-04-15' '**************************************************
'----------SetHttpOnlyCookie----------------------------------------'功能:设置HttpOnly Cookie'参数:expDate 为保到期， 0表示不设置，设置为过去某一时间表示清除'参数:domain 为空(string.Empty)表示不设置'-------------------------------------------------------------------Function SetHttpOnlyCookie(cookieName,cookieValue,domain,path,expDate) Dim cookie cookie=cookieName & "=" & Server.URLEncode(cookieValue) & "; path=" & path If expDate <> 0 Then cookie=cookie & "; expires=" & DateToGMT(expDate) End If If domain <> "" Then cookie=cookie & "; domain=" & domain End If
cookie=cookie & "; HttpOnly" Call Response.AddHeader ("Set-Cookie", cookie) End Function
'-------------getGMTTime------------'参数: sDate 需要转换成GMT的时间'---------------------------------Function DateToGMT(sDate) Dim dWeek,dMonth Dim strZero,strZone strZero="00" strZone="+0800" dWeek=Array("Sun","Mon","Tue","Wes","Thu","Fri","Sat") dMonth=Array("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec") DateToGMT = dWeek(WeekDay(sDate)-1)&", "&Right(strZero&Day(sDate),2)&" "&dMonth(Month(sDate)-1)&" "&Year(sDate)&" "&Right(strZero&Hour(sDate),2)&":"&Right(strZero&Minute(sDate),2)&":"&Right(strZero&Second(sDate),2)&" "&strZoneEnd Function'参考'Call SetHttpOnlyCookie("cookieOnly1","onlyValue",".gyzs.com","/",0) %>
参考文章:http://www.asp101.com/tips/index.asp?id=160
