Use HttpOnly for cookie-config
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/33f1cb9b Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/33f1cb9b Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/33f1cb9b Branch: refs/heads/1.3.x-fixes Commit: 33f1cb9ba1b2c655d9d9371249e0d28804170359 Parents: 064ad65 Author: Colm O hEigeartaigh <[email protected]> Authored: Mon Nov 28 16:36:51 2016 +0000 Committer: Colm O hEigeartaigh <[email protected]> Committed: Mon Nov 28 17:39:14 2016 +0000 ---------------------------------------------------------------------- services/idp/src/main/webapp/WEB-INF/web.xml | 3 +++ services/oidc/src/main/webapp/WEB-INF/web.xml | 3 +++ 2 files changed, 6 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/33f1cb9b/services/idp/src/main/webapp/WEB-INF/web.xml ---------------------------------------------------------------------- diff --git a/services/idp/src/main/webapp/WEB-INF/web.xml b/services/idp/src/main/webapp/WEB-INF/web.xml index 4129e72..807fa23 100644 --- a/services/idp/src/main/webapp/WEB-INF/web.xml +++ b/services/idp/src/main/webapp/WEB-INF/web.xml @@ -26,6 +26,9 @@ under the License. <display-name>Fediz IDP</display-name> <session-config> + <cookie-config> + <http-only>true</http-only> + </cookie-config> <tracking-mode>COOKIE</tracking-mode> </session-config> http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/33f1cb9b/services/oidc/src/main/webapp/WEB-INF/web.xml ---------------------------------------------------------------------- diff --git a/services/oidc/src/main/webapp/WEB-INF/web.xml b/services/oidc/src/main/webapp/WEB-INF/web.xml index ebc17f0..a41a03b 100644 --- a/services/oidc/src/main/webapp/WEB-INF/web.xml +++ b/services/oidc/src/main/webapp/WEB-INF/web.xml @@ -25,6 +25,9 @@ <display-name>WS Federation Spring Example</display-name> <session-config> + <cookie-config> + <http-only>true</http-only> + </cookie-config> <tracking-mode>COOKIE</tracking-mode> </session-config>
