Cookie概要

 
  以下内容适合IE6.0浏览器

  1. Cookie用来保存信息,是Session,Asp.net Form认证的基础

  2.Cookie 有 Name, Value,Domain, Expires,Path,HttpOnly等属性

  3. Cookie 按存在时间分临时Cookie,跟持久Cookie.
   临时Cookie没指明Expires属性,因此不会在IE的临时文件夹中生成相应cookie文件,而持久cookie是指设置了expires属性,(具体时间可以是比当前时间多1秒或者2秒...,不一定是很长的时间),这样的cookie会在IE临时文件夹下生成一个cookie文件,当然这个cookie文件会在expires到期后自动删除掉.

  4. IE6.0支持Cookie HttpOnly 属性,指定了HttpOnly属性的cookie 不允许客户端脚本访问如: URL(地址栏)中输入javascript:alert(document.cookie) 将显示含HttpOnly属性的cookie,当然着也意味着javascript无法生成含httpOnly的cookie, 这样可以在一定程度上避免跨站点脚本攻击.
Asp.net2.0以及以后版本中的HttpCookie类可以直接设置HttpOnly属性,不过Asp中你需要类似下面的处理:

-------代码--------------

<%
'**************************************************
'ASP 中输出httponly cookie IE6.0以上浏览器支持
'WDFrog
'2009-04-15
'<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
'**************************************************

'----------SetHttpOnlyCookie----------------------------------------
'功能:设置HttpOnly Cookie
'参数:expDate 为保到期， 0表示不设置，设置为过去某一时间表示清除
'参数:domain 为空(string.Empty)表示不设置
'-------------------------------------------------------------------
Function SetHttpOnlyCookie(cookieName,cookieValue,domain,path,expDate)
  Dim cookie
  cookie=cookieName & "=" & Server.URLEncode(cookieValue) & "; path=" & path
  If expDate <> 0 Then
    cookie=cookie & "; expires=" & DateToGMT(expDate)
  End If
 
  If domain <> "" Then
    cookie=cookie & "; domain=" & domain
  End If

  cookie=cookie & "; HttpOnly"
 
  Call Response.AddHeader ("Set-Cookie", cookie)
End Function

'-------------getGMTTime------------
'参数: sDate 需要转换成GMT的时间
'---------------------------------
Function DateToGMT(sDate)
   Dim dWeek,dMonth
   Dim strZero,strZone
   strZero="00"
   strZone="+0800"
   dWeek=Array("Sun","Mon","Tue","Wes","Thu","Fri","Sat")
   dMonth=Array("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec")
   DateToGMT = dWeek(WeekDay(sDate)-1)&", "&Right(strZero&Day(sDate),2)&" "&dMonth(Month(sDate)-1)&" "&Year(sDate)&" "&Right(strZero&Hour(sDate),2)&":"&Right(strZero&Minute(sDate),2)&":"&Right(strZero&Second(sDate),2)&" "&strZone
End Function
'参考
'Call SetHttpOnlyCookie("cookieOnly1","onlyValue",".gyzs.com","/",0)
 
%>

参考文章:
http://www.asp101.com/tips/index.asp?id=160