[JIRA] Reopened: (SDSJ-90) Hardening the '_saml_idp' cookie in the centralized DS

[Rod Widdowson (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SDSJ-90?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Rod Widdowson reopened SDSJ-90:
-------------------------------


Final testing of V1.1.3 flushed a day one bug exposed by this change.

I'm going reopen this case until I know we are good.

> Hardening the '_saml_idp' cookie in the centralized DS
> ------------------------------------------------------
>
>                 Key: SDSJ-90
>                 URL: https://issues.shibboleth.net/jira/browse/SDSJ-90
>             Project: Shibboleth Discovery Service - Java
>          Issue Type: Bug
>    Affects Versions: 1.1.2
>            Reporter: Tom Scavo
>            Assignee: Rod Widdowson
>            Priority: Minor
>             Fix For: 1.1.3
>
>          Time Spent: 4 hours
>  Remaining Estimate: 0 minutes
>
> Note the following issues with respect to the '_saml_idp' cookie used in the centralized DS:
> * In the SamlCookiePlugin class, the static getCookie method should take into account the path and domain in addition to the cookie name
> * The SamlCookiePlugin constructor should ensure that the configured 'cacheDomain' attribute has a leading dot as required by RFC 2965
> * The '_saml_idp' cookie used by the CDS is not marked as 'secure' (is this a security vulnerability?)
> * The 'cacheDomain' configuration property is an undocumented feature but I think it should be documented since it allows the deployer to configure a centralized DS such that the '_saml_idp' cookie is equivalent to the so-called common domain cookie. Out of the box, the '_saml_idp' cookie defaults to the request-host (not a common domain).

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira