🦑 paid pds

🦑 nginx cookie validity period guide by undercode

> Every visit is generated in the browser Cookie, so is Cookiethe existence good or bad for the user? To be honest, the existence of this thing does bring a series of problems. It is interesting that almost every site is difficult to leave Cookie. Because Cookieof its seemingly simple use, it is easy to be underestimated. In the recent development process, reviewing the Cookiecode in the application can obtain huge security benefits at almost a small cost. So write this note to deepen your memory.

🦑Cookie security risks

1) In the actual application scenario, Cookiethe one thing that is used the most is to maintain the identity authentication server state.

2) This hold may be session- Sessionbased, or it may be persistent. However, no matter which one, once the Cookieserver ticket included in the identity authentication Ticketis leaked, it will be difficult for the server to distinguish whether the user request with this ticket comes from a real user or a malicious ***.

3) In actual cases, the Cookiemost leaked way is through cross-site scripting (such as XSS, Cross Site Script) vulnerabilities.

4) The user can JavaScriptsteal an important identity representing the user's identity through a small piece of code Cookie. Because cross-site scripting vulnerabilities are so common (don't think that simple ones HTML Encodecan avoid being cross-site, cross-site is a very deep knowledge, so that a dedicated term in the industry: cross-site division), almost every Websites are inevitable, so this method is a commonly used method in practice.

5) In fact avoid this problem first secret is to do all possible, give your Cookieadd HttpOnlytags. HttpOnlyThe specific use of is outside the scope here

🦑How cookies work ?


When you visit the website for the first time, the browser sends a request, and after the server responds to the request, it will be Cookieput into the response request. When the browser sends the request for the second time, it will be Cookietaken over, and the server will identify the user, Of course, the server can also modify the Cookiecontent.

🦑Cookie life cycle :

When it is created Cookie, it will be Cookieassigned a value:, Expireit is the specified Cookievalidity period, that is Cookie, the life cycle, beyond the set life cycle, Cookieit will be cleared. If this value is Expireset to a 0negative value, then this setting will be cleared when the browser is closed Cookie, which is more secure.

🦑Modify cookie validity

1) Under normal circumstances, our webapplication services will nginxbe published, at this time, we can nginxchange cookiethe validity period by modifying the configuration file above , because the author is recently based openrestyon the nginxfunction development. Just take this opportunity to start Cookiethe status test of the validity period.

2) As Cookiementioned above in the life cycle, we can Cookieset a reasonable validity period for the safety of the validity period. If 0yes or negative, what is the effect? May wish to take a look

🦑Modify ideas

1) The Use Openrestyof resty.cookieModified. At The Library Used to IS OpenRestyat The HTTP cookieOperation. Of Can BE Used for Nginxparsing HTTP Cookie headerand returning Cookiethe each Field, in. SUCH AS Setting name, value, httponlyand the Properties OTHER

2) Valid for 24h

Here will be expiresset to the validity period is one day (24h), that is, the current system time (ngx.time())plus 24h

🦑effect