javascript - 如何从 cookie 中获取 http 模式为 true 的值

Question

我想使用 js 获取 http 模式为 true 的 cookie 值。

var x = document.cookie;

我只使用 http 模式为 false 的那个值(例如:Nopcommerce.RecentlyViewedProducts)。

在这张图片中，我想要获取值 Nop.customer。如何获得？

Answer 1

你不能这样做。 cookie 上 HttpOnly 标志的全部意义在于它不能被客户端脚本访问。它只是由浏览器发送到服务器。来自 OWASP :

If the HttpOnly flag (optional) is included in the HTTP response header, the cookie cannot be accessed through client side script (again if the browser supports this flag). As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser (primarily Internet Explorer) will not reveal the cookie to a third party.