java - 将 HTTPOnly cookie 与 android 中的其他 cookie 区分开来

Question

在我当前的项目中，我们正在 Android 应用程序和服务器之间实现 session 处理。现在，根据我们的设计，Android 应用程序应该只接受 HTTP Cookie 并删除所有其他 cookie。但是查看所有可用选项，我找不到任何类或方法来帮助我确定 cookie 是否为 HTTPOnly。

我以下列方式存储 cookie:

        connections = (HttpURLConnection) serverURL.openConnection();
        // Setting cookies manager
        java.net.CookieManager manager = new java.net.CookieManager();
        manager.setCookiePolicy(new CookiePolicy() {
            
            @Override
            public boolean shouldAccept(URI uri, HttpCookie cookie) {
                return cookie.getSecure();
            }
        });
        CookieHandler.setDefault(manager);

        connections.setDoInput(true);
        connections.setDoOutput(true);
        connections.setConnectTimeout(TIME_OUT);

        connections.getOutputStream().write(data);

        InputStream inputStream = connections.getInputStream();
        CookieStore cookieJar = manager.getCookieStore();
        if (cookieJar != null) {
            List<HttpCookie> cookies = cookieJar.getCookies();
            for (HttpCookie httpCookie : cookies) {
                
                Log.i("yash", httpCookie.toString());
            }
        }

但是这个HttpCookie没有任何 HTTPOnly 方法。

通过一些谷歌浏览我发现 RFC 6265有 HTTPOnly 属性，它也 obsulate RFC 2965。但为什么谷歌不支持这个 RFC 6265？

Answer 1

根据 the class documentation支持 HttpOnly，但由于某种原因，该字段没有任何访问器或修改器。

要能够访问和修改 httpOnly 字段，您应该使用反射:

// Workaround httpOnly (getter)
private boolean getHttpOnly() {
    try {
        Field fieldHttpOnly = cookie.getClass().getDeclaredField("httpOnly");
        fieldHttpOnly.setAccessible(true);

        return (boolean) fieldHttpOnly.get(cookie);
    } catch (Exception e) {
        // NoSuchFieldException || IllegalAccessException ||
        // IllegalArgumentException
        Log.w(TAG, e);
    }
    return false;
}

// Workaround httpOnly (setter)
private void setHttpOnly(boolean httpOnly) {
    try {
        Field fieldHttpOnly = cookie.getClass().getDeclaredField("httpOnly");
        fieldHttpOnly.setAccessible(true);

        fieldHttpOnly.set(cookie, httpOnly);
    } catch (Exception e) {
        // NoSuchFieldException || IllegalAccessException ||
        // IllegalArgumentException
        Log.w(TAG, e);
    }
}