[JIRA] Resolved: (SSPCPP-375) Add httpOnly to cookieProps in the shibboleth2.xml config

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-375?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-375.
---------------------------------

    Resolution: Fixed

http://svn.shibboleth.net/view/cpp-sp?view=revision&revision=3517

Getting this in early so I can test through the life cycle with HttpOnly set.

> Add httpOnly to cookieProps in the shibboleth2.xml config
> ---------------------------------------------------------
>
>                 Key: SSPCPP-375
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-375
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>          Components: Configuration
>            Reporter: Thomas Lenggenhager
>            Assignee: Scott Cantor
>            Priority: Trivial
>             Fix For: 2.5
>
>   Original Estimate: 15 minutes
>  Remaining Estimate: 15 minutes
>
> Since modern browsers support the httpOnly cookie attribute, it should be added to the default shibboleth2.xml config. Currently, cookieProps is not included in the default config. In a comment, only the path and secure attribtes are mentioned, httpOnly is missing completely.
> See: [http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly]

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira