Hello, By default, TGC cookie does _not_ have HttpOnly. If the app. (using CAS for authentication) has XSS vulnerability, someone could inject JS and read TGC cookie and submit to CAS server, even though it is encrypted and signed, CAS server will not know this TGC cookie is from an attacker. Is that not an issue?
Granted, it maybe little an attacker could do, I guess he could request a service ticket for his app., now that he has TGC cookie? Thx! Yan On Fri, Mar 31, 2017 at 2:25 AM, Alejandro Rodriguez <[email protected]> wrote: > > Misagh, Thank you very much for the clarification, I will try to issue a > problem as you advise me > although I never did. Again, thank you very much. > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: https://apereo.github.io/cas/ > Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion on the web visit https://groups.google.com/a/ > apereo.org/d/msgid/cas-user/7513216f-2088-4c4e-b973- > e385d37d99b7%40apereo.org > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/7513216f-2088-4c4e-b973-e385d37d99b7%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAFSoZemWs%3DEXP5YWr6_fVqBTVPPcy1CR1fzAcRPdzN6r1kVwsg%40mail.gmail.com.
