Hi there, I have a CAS 4.1.X overlay, servlet API version 3 in POM.xml, and CAS running on tomcat7.
I observed that TGC cookie is set to Secure, but NOT httpOnly. Tomcat7 default to HttpOnly for session cookie but it does not know about CAS TGC cookie, so the CAS web app's session cookie has HttpOnly set, but TGC cookie does not. The source code in CookieRetrievingCookieGenerator.java shows, CAS would set to HttpOnly if "RememberMe" is on. Am I missing something, should not TGC cookie always have HttpOnly on all the times? This URL explains how to customize CAS to do that. But I am wondering why this would require customization. http://daodecode.com/2013/03/25/castgc-cookie-and-httponly-flag/ Thx! Yan public void addCookie(final HttpServletRequest request, final HttpServletResponse response, final String cookieValue) { final String theCookieValue = this.casCookieValueManager.buildCookieValue(cookieValue, request); if (!StringUtils.hasText(request.getParameter(RememberMeCredential.REQUEST_PARAMETER_REMEMBER_ME))) { super.addCookie(response, theCookieValue); } else { final Cookie cookie = createCookie(theCookieValue); cookie.setMaxAge(this.rememberMeMaxAge); if (isCookieSecure()) { cookie.setSecure(true); } if (isCookieHttpOnly()) { final Method setHttpOnlyMethod = ReflectionUtils.findMethod(Cookie.class, "setHttpOnly", boolean.class); if(setHttpOnlyMethod != null) { cookie.setHttpOnly(true); } else { logger.debug("Cookie cannot be marked as HttpOnly; container is not using servlet 3.0."); } } response.addCookie(cookie); } } -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/670c4ad5-7a68-4762-927b-13575b5bd52d%40apereo.org.
