[
https://issues.apache.org/jira/browse/WW-5848?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart updated WW-5848:
------------------------------
Fix Version/s: 7.6.0
Priority: Minor (was: Major)
> Struts Boot: make the session cookie attributes configurable (Secure,
> SameSite)
> -------------------------------------------------------------------------------
>
> Key: WW-5848
> URL: https://issues.apache.org/jira/browse/WW-5848
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Lukasz Lenart
> Priority: Minor
> Fix For: 7.6.0
>
>
> Follow-up to [WW-5841|https://issues.apache.org/jira/browse/WW-5841] (review
> of PR [#2117|https://github.com/apache/struts/pull/2117]).
> After WW-5841 the embedded Tomcat context in {{StrutsBootServer}} tracks
> sessions by cookie only and sets {{SameSite=Lax}} on the session cookie
> through a hard-coded {{Rfc6265CookieProcessor}}. The {{Secure}} attribute is
> never set.
> A Boot application has no way to change either value: there is no
> {{web.xml}}, {{StrutsBootApplication}} exposes only
> {{actions(ActionRegistry)}}, and {{BootSettings}} carries only
> {{struts.boot.port}}, {{struts.boot.address}} and
> {{struts.boot.contextPath}}. An operator who terminates TLS in front of Boot
> cannot mark the session cookie {{Secure}}, and an application that is
> embedded cross-site cannot switch {{SameSite}} to {{None}}.
> Proposal: two new {{struts.boot.*}} settings, read by {{BootSettings}} and
> applied in {{StrutsBootServer}} next to the existing session defaults:
> * {{struts.boot.session.cookie.secure}} — {{true}} or {{false}}, default
> {{false}} (Boot opens a plain HTTP listener by default; a browser drops a
> {{Secure}} cookie on {{http://}}). Applied via the servlet context's
> {{SessionCookieConfig#setSecure}}.
> * {{struts.boot.session.cookie.sameSite}} — {{lax}} (default), {{strict}},
> {{none}} or {{unset}}, the values Tomcat's {{SameSiteCookies}} accepts.
> Applied via {{Rfc6265CookieProcessor#setSameSiteCookies}}.
> Invalid values throw a {{ConfigurationException}} naming the setting and the
> value, as the other {{struts.boot.*}} settings do.
> Tests owed in {{StrutsBootTomcatTest}}: the defaults stay {{SameSite=Lax}}
> without {{Secure}}; {{secure=true}} adds {{Secure}}; {{sameSite=none}} and
> {{sameSite=strict}} are reflected in {{Set-Cookie}}; an invalid value fails
> startup. The Boot documentation page lists both settings, and
> {{THREAT_MODEL.md}} §5 keeps the defaults as the framework-owned values.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
