Hi, I have the same question. My environment is CAS ovelay 5.0.3.1 with Tomcat 8.0 and java 1.8 and I do not understand how it is possible that the TGC cookie can not be officially configured as httponly. I have tested the embedded environment with the same result. I am doing something wrong? >From my humble opinion I understand it as a great security problem for a >Single Sign ON. Someone could tell me if I'm right? Thank you so much.
El jueves, 9 de marzo de 2017, 16:49:07 (UTC+1), Yan Zhou escribió: > > > I added httpOnly flag in the XML, that worked for me. Does this > solution sound right? > > <bean id="ticketGrantingTicketCookieGenerator" > class="org.jasig.cas.web.support.CookieRetrievingCookieGenerator" > c:casCookieValueManager-ref="cookieValueManager" > p:cookieHttpOnly="true" > > > > On Thursday, March 9, 2017 at 10:21:48 AM UTC-5, Yan Zhou wrote: >> >> Hi there, >> >> I have a CAS 4.1.X overlay, servlet API version 3 in POM.xml, and CAS >> running on tomcat7. >> >> I observed that TGC cookie is set to Secure, but NOT httpOnly. Tomcat7 >> default to HttpOnly for session cookie but it does not know about CAS TGC >> cookie, so the CAS web app's session cookie has HttpOnly set, but TGC >> cookie does not. >> >> The source code in CookieRetrievingCookieGenerator.java shows, CAS would >> set to HttpOnly if "RememberMe" is on. >> >> Am I missing something, should not TGC cookie always have HttpOnly on all >> the times? This URL explains how to customize CAS to do that. But I am >> wondering why this would require customization. >> >> http://daodecode.com/2013/03/25/castgc-cookie-and-httponly-flag/ >> >> Thx! >> Yan >> >> public void addCookie(final HttpServletRequest request, final >> HttpServletResponse response, final String cookieValue) { >> final String theCookieValue = >> this.casCookieValueManager.buildCookieValue(cookieValue, request); >> >> if >> (!StringUtils.hasText(request.getParameter(RememberMeCredential.REQUEST_PARAMETER_REMEMBER_ME))) >> >> { >> super.addCookie(response, theCookieValue); >> } else { >> final Cookie cookie = createCookie(theCookieValue); >> cookie.setMaxAge(this.rememberMeMaxAge); >> if (isCookieSecure()) { >> cookie.setSecure(true); >> } >> if (isCookieHttpOnly()) { >> final Method setHttpOnlyMethod = >> ReflectionUtils.findMethod(Cookie.class, "setHttpOnly", boolean.class); >> if(setHttpOnlyMethod != null) { >> cookie.setHttpOnly(true); >> } else { >> logger.debug("Cookie cannot be marked as HttpOnly; >> container is not using servlet 3.0."); >> } >> } >> response.addCookie(cookie); >> } >> } >> >> -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/400a01aa-b557-420c-94e1-449646a1a5a5%40apereo.org.
