JwtAuthProvider在不是httpOnly的响应头中发出bearToken - ServiceStack

Question

我已将ServiceStack AllowNonHttpOnlyCookies设置为true：

Config.AllowNonHttpOnlyCookies = true;

这确实从响应头中的某些Set-Cookie中删除了httponly：

我想删除httpsly以获取“ss-tok”的Set-Cookie响应标头。

我查看了JwtAuthProvider的选项，但没有找到任何内容。

这是我的AuthFeature配置：

        Config.AllowNonHttpOnlyCookies = true;

        Plugins.Add(new AuthFeature(() => new CustomUserSession(),
            new IAuthProvider[] {
                new JwtAuthProvider
                {
                    HashAlgorithm = AuthSettings.HashAlgorithm,
                    RequireSecureConnection = requireSecureConnection,
                    AuthKeyBase64 = AuthSettings.JwtAuthKeyBase64,
                    ExpireTokensIn        = TimeSpan.FromHours(_configuration["AuthSettings:ExpireTokensIn"].ToDouble()),
                    ExpireRefreshTokensIn = TimeSpan.FromHours(_configuration["AuthSettings:ExpireRefreshTokensIn"].ToDouble()),
                    CreatePayloadFilter = (payload,session) => {
                            payload["zipCode"] = ((CustomUserSession)session).ZipCode;
                    },
                    PopulateSessionFilter = AuthSettings.PopulateSessionFilterImplementation
                },
                new CustomCredentialsAuthProvider(HostContext.Resolve<ITsoContext>()) //HTML Form post of User/Pass
            }));

P.S。：我对此应用程序没有很高的安全性问题

Answer 1

JWT Token Cookies使用recommended httpOnly for JWT Cookies by design来防止XSS攻击，它不可覆盖。