java - HttpsURLConnection getHeaderFields 不返回 set-cookie

Question

我正在向一个 HTTPS URL 发送一个获取请求，但不知何故我得到了“Set-Cookie”的空值。迭代时，我可以看到 header-key 有“set-cookie”，但 header-value 为 null。

这是我的代码:

URL obj = new URL(url);
HttpsURLConnection conn = (HttpsURLConnection) obj.openConnection();
HttpsURLConnection.setFollowRedirects(false);


conn.setRequestProperty("User-Agent", USER_AGENT);
conn.setRequestProperty("Accept",
            "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
conn.setRequestProperty("Accept-Language", "en-US,en;q=0.5");
conn.setRequestProperty("Connection", "keep-alive");
conn.setRequestProperty("Accept-Encoding", "gzip, deflate");
conn.connect();

Map em = conn.getHeaderFields();
System.out.println("header Values......" + em.toString());

String headerName = null;   

for (int i = 1; (headerName = conn.getHeaderFieldKey(i)) != null; i++) 
{
     System.out.println("Header Nme : " + headerName);
     System.out.println(conn.getHeaderField(i));

}

输出:

header Values......{null=[HTTP/1.1 200 OK], x-wily-info=[Clear guid=0BE0EC9D0A7E67816C471FA946FD2EBB], Date=[Sat, 29 Mar 2014 03:27:41 GMT], Content-Length=[8106], x-wily-servlet=[*******************], X-FRAME-OPTIONS=[SAMEORIGIN], Connection=[close], Content-Type=[text/html;charset=UTF-8]}Header Nme : DateSat, 29 Mar 2014 03:27:41 GMTHeader Nme : X-FRAME-OPTIONSSAMEORIGINHeader Nme : x-wily-infoClear guid=0BE0EC9D0A7E67816C471FA946FD2EBBHeader Nme : x-wily-servlet*****************************Header Nme : Content-Typetext/html;charset=UTF-8Header Nme : Content-Length8106**Header Nme : Set-CookienullHeader Nme : Set-Cookienull**Header Nme : ConnectioncloseResponse Code : 200

从浏览器我可以看到如下:

Connection  closeContent-Length  8106Content-Type    text/html;charset=UTF-8Date            Sat, 29 Mar 2014 02:20:31 GMTSet-Cookie  JSESSIONID=*********************; Path=/****; Secure; **HttpOnly** Set-Cookie      loginToken=*************;Path=/****/login/LoginProcess.do; **HttpOnly**;                                                                                                           SecureX-FRAME-OPTIONS SAMEORIGINx-wily-info Clear guid=0BA36F4A0A7E67816C471FA938E304CAx-wily-servlet  *****************************************

我在许多 HTTPS URL 上进行了相同的尝试，它们都工作正常，这个只是造成问题；我注意到的主要区别是该服务器实际上将 cookie 作为“HttpOnly”发送。它会导致问题吗？

Answer 1

由于 XSS 问题，这似乎是一项功能。

https://bugs.openjdk.java.net/browse/JDK-6890023