让你的web应用更安全

• X-Frame-Options
• Cookie of secure and httpOnly

设置X-Frame-Options

• DENY
  表明网页内容不可以被嵌入到任何frame中

• ALLOW-FROM
  指定具体的来源

服务器配置

Apache

添加站点配置：

Header always append X-Frame-Options SAMEORIGIN

Nginx

add_header X-Frame-Options SAMEORIGIN;

IIS

添加到站点的 Web.config

<system.webServer>
  ...

  <httpProtocol>
    <customHeaders>
      <add name="X-Frame-Options" value="SAMEORIGIN" />
    </customHeaders>
  </httpProtocol>

  ...
</system.webServer>

HAProxy

添加到 frontend, listen, 或者 backend 配置中:

rspadd X-Frame-Options:\ SAMEORIGIN

更安全的Cookie

Set-Cookie: name=value[; expires=date][; domain=domain][; path=path][; secure][; httpOnly]

可以看到，Cookie主要包含一下几个字段：

• name
• value
• expire
• domain
• path
• secure
• httpOnly

httpOnly标识

用来告诉浏览器不能通过JavaScript的 document.cookie 来访问 cookie, 目的是避免 跨站脚本攻击 (XSS)

secure标识

强制应用通过Https来传输 Cookie

PHP Yii2中设置Cookie的 httpOnly 和 secure

设置 _csrf

class Cookie extends \yii\base\Object
{ 
    public $name;
    public $value = '';
    public $domain = '';
    public $expire = 0;
    public $path = '/';
    public $secure = false;
    public $httpOnly = true;
}

在 config/main.php 中

    ...
    'components' => [
        'request' => [
            'csrfCookie' => [
                'httpOnly' => true,
                'secure'   => SECURE_COOKIE,
            ],
        ],
    ...
    ]
    ...

生成secure的 Cookie

$cookies = Yii::$app->response->cookies;
$cookies->add(new Cookie([
    'name' => 'accesstoken', 
    'value' => $accessToken, 
    'expire' => time() + Token::EXPIRE_TIME, 
    'secure' => SECURE_COOKIE
    ])
);

注意更新 Cookie 的时候也需要更新 secure 属性

$cookies = Yii::$app->request->cookies;
if (($cookie = $cookies->get('accesstoken')) !== null) {
    $cookie->secure = SECURE_COOKIE;
    // 这里很重要, 不然就会丢失
    $cookie->expire = time() + Token::EXPIRE_TIME;
    Yii::$app->response->cookies->add($cookie);
}