https://souljian.cn/tags/%E4%BC%9A%E8%AF%9D/Recent content in 会话 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088231/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088231/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>本文讲 Cookie/Session 基础，不涉及攻击。</p> <h2 id="一cookie-与-session">一、Cookie 与 Session </h2><img src="https://souljian.cn/img/osi-tcp-model.svg" alt="Cookie 与 Session" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">Cookie（客户端）· Session（服务端） </span></span></code></pre></td></tr></table> </div> </div><h2 id="二安全属性">二、安全属性 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">HttpOnly：禁止 JavaScript 读取 </span></span><span class="line"><span class="cl">Secure：仅 HTTPS 传输 </span></span><span class="line"><span class="cl">SameSite：防止 CSRF </span></span></code></pre></td></tr></table> </div> </div><h2 id="三小结">三、小结 </h2><p>Cookie + Session 是 Web 会话管理的核心。<strong>HttpOnly + Secure + SameSite</strong> 是安全配置三要素。</p>