[utilities COMMIT] /java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java

[noreply at shibboleth.net]

Author: scantor
Date: Mon Apr  7 09:23:47 2014
New Revision: 555

URL: http://svn.shibboleth.net/view/utilities?rev=555&view=rev
Log:
Wrap servlet 3.0 option for HttpOnly.

Modified:
    java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java

Modified: java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
URL: http://svn.shibboleth.net/view/utilities/java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java?rev=555&r1=554&r2=555&view=diff
==============================================================================
--- java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java (original)
+++ java-support/trunk/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java Mon Apr  7 09:23:47 2014
@@ -54,12 +54,16 @@
     
     /** Is cookie secure? */
     private boolean secure;
+
+    /** Is cookie marked HttpOnly? */
+    private boolean httpOnly;
     
     /** Maximum age in seconds, or -1 for session. */
     private int maxAge;
     
     /** Constructor. */
     public CookieManager() {
+        httpOnly = true;
         secure = true;
         maxAge = -1;
     }
@@ -119,6 +123,16 @@
         secure = flag;
     }
 
+
+    /**
+     * Set the HttpOnly flag.
+     * 
+     * @param flag flag to set
+     */
+    public void setHttpOnly(final boolean flag) {
+        httpOnly = flag;
+    }
+    
     /**
      * Maximum age in seconds, or -1 for per-session.
      * 
@@ -150,6 +164,7 @@
             cookie.setDomain(cookieDomain);
         }
         cookie.setSecure(secure);
+        cookie.setHttpOnly(httpOnly);
         cookie.setMaxAge(maxAge);
         
         httpResponse.addCookie(cookie);
@@ -167,6 +182,7 @@
             cookie.setDomain(cookieDomain);
         }
         cookie.setSecure(secure);
+        cookie.setHttpOnly(httpOnly);
         cookie.setMaxAge(0);
         
         httpResponse.addCookie(cookie);