[JIRA] Updated: (SSPCPP-375) Add httpOnly to cookieProps in the shibboleth2.xml config

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-375?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated SSPCPP-375:
--------------------------------

     Affects Version/s:     (was: 2.4.3)
         Fix Version/s: 2.5
    Remaining Estimate: 15 minutes
     Original Estimate: 15 minutes

> Add httpOnly to cookieProps in the shibboleth2.xml config
> ---------------------------------------------------------
>
>                 Key: SSPCPP-375
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-375
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>          Components: Configuration
>            Reporter: Thomas Lenggenhager
>            Assignee: Scott Cantor
>            Priority: Trivial
>             Fix For: 2.5
>
>   Original Estimate: 15 minutes
>  Remaining Estimate: 15 minutes
>
> Since modern browsers support the httpOnly cookie attribute, it should be added to the default shibboleth2.xml config. Currently, cookieProps is not included in the default config. In a comment, only the path and secure attribtes are mentioned, httpOnly is missing completely.
> See: [http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly]

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira