[cpp-sp COMMIT] in /branches/REL_2: configs/example-shibboleth2.xml configs/shibboleth2.xml configs/win-shibboleth2.x...

[noreply at shibboleth.net]

Author: scantor
Date: Tue Sep 20 22:15:37 2011
New Revision: 3517

URL: http://svn.shibboleth.net/view/cpp-sp?rev=3517&view=rev
Log:
https://issues.shibboleth.net/jira/browse/SSPCPP-375

Modified:
    branches/REL_2/configs/example-shibboleth2.xml
    branches/REL_2/configs/shibboleth2.xml
    branches/REL_2/configs/win-shibboleth2.xml
    branches/REL_2/shibsp/Application.cpp
    branches/REL_2/shibsp/handler/impl/AssertionConsumerService.cpp

Modified: branches/REL_2/configs/example-shibboleth2.xml
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/configs/example-shibboleth2.xml?rev=3517&r1=3516&r2=3517&view=diff
==============================================================================
--- branches/REL_2/configs/example-shibboleth2.xml (original)
+++ branches/REL_2/configs/example-shibboleth2.xml Tue Sep 20 22:15:37 2011
@@ -100,7 +100,7 @@
         You MUST supply an effectively unique handlerURL value for each of your applications.
         The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
         a relative value based on the virtual host. Using handlerSSL="true", the default, will force
-        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
+        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure; HttpOnly"
         in that case. Note that while we default checkAddress to "false", this has a negative
         impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
         -->

Modified: branches/REL_2/configs/shibboleth2.xml
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/configs/shibboleth2.xml?rev=3517&r1=3516&r2=3517&view=diff
==============================================================================
--- branches/REL_2/configs/shibboleth2.xml (original)
+++ branches/REL_2/configs/shibboleth2.xml Tue Sep 20 22:15:37 2011
@@ -28,7 +28,7 @@
         You MUST supply an effectively unique handlerURL value for each of your applications.
         The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
         a relative value based on the virtual host. Using handlerSSL="true", the default, will force
-        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
+        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure; HttpOnly"
         in that case. Note that while we default checkAddress to "false", this has a negative
         impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
         -->

Modified: branches/REL_2/configs/win-shibboleth2.xml
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/configs/win-shibboleth2.xml?rev=3517&r1=3516&r2=3517&view=diff
==============================================================================
--- branches/REL_2/configs/win-shibboleth2.xml (original)
+++ branches/REL_2/configs/win-shibboleth2.xml Tue Sep 20 22:15:37 2011
@@ -71,7 +71,7 @@
         You MUST supply an effectively unique handlerURL value for each of your applications.
         The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
         a relative value based on the virtual host. Using handlerSSL="true", the default, will force
-        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure"
+        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure; HttpOnly"
         in that case. Note that while we default checkAddress to "false", this has a negative
         impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
         -->

Modified: branches/REL_2/shibsp/Application.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/Application.cpp?rev=3517&r1=3516&r2=3517&view=diff
==============================================================================
--- branches/REL_2/shibsp/Application.cpp (original)
+++ branches/REL_2/shibsp/Application.cpp Tue Sep 20 22:15:37 2011
@@ -60,7 +60,7 @@
 
 pair<string,const char*> Application::getCookieNameProps(const char* prefix, time_t* lifetime) const
 {
-    static const char* defProps="; path=/";
+    static const char* defProps="; path=/; HttpOnly";
 
     if (lifetime)
         *lifetime = 0;

Modified: branches/REL_2/shibsp/handler/impl/AssertionConsumerService.cpp
URL: http://svn.shibboleth.net/view/cpp-sp/branches/REL_2/shibsp/handler/impl/AssertionConsumerService.cpp?rev=3517&r1=3516&r2=3517&view=diff
==============================================================================
--- branches/REL_2/shibsp/handler/impl/AssertionConsumerService.cpp (original)
+++ branches/REL_2/shibsp/handler/impl/AssertionConsumerService.cpp Tue Sep 20 22:15:37 2011
@@ -475,7 +475,9 @@
     pair<bool,bool> idpHistory=sessionProps->getBool("idpHistory");
 
     if (idpHistory.first && idpHistory.second) {

[... 8 lines stripped ...]