[java-support] 03/04: IDP-1223 - IdPv3 defaults to insecure cookies

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch master
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=4ef3437529a0fdbe3bd88b53c44eafdf4dc0828d

commit 4ef3437529a0fdbe3bd88b53c44eafdf4dc0828d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Sep 27 21:10:01 2017 -0400

    IDP-1223 - IdPv3 defaults to insecure cookies
    
    https://issues.shibboleth.net/jira/browse/IDP-1223
    
    Add warning when httpOnly/secure are false.
---
 .../net/shibboleth/utilities/java/support/net/CookieManager.java  | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java b/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
index 657c38a..16b880c 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
@@ -23,6 +23,9 @@ import javax.servlet.http.Cookie;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
 import net.shibboleth.utilities.java.support.annotation.constraint.NonnullAfterInit;
 import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
 import net.shibboleth.utilities.java.support.component.AbstractInitializableComponent;
@@ -40,6 +43,9 @@ import net.shibboleth.utilities.java.support.primitive.StringSupport;
  */
 public final class CookieManager extends AbstractInitializableComponent {
 
+    /** Class logger. */
+    @Nonnull private final Logger log = LoggerFactory.getLogger(CookieManager.class);
+
     /** Path of cookie. */
     @Nullable private String cookiePath;
 
@@ -161,6 +167,8 @@ public final class CookieManager extends AbstractInitializableComponent {
         
         if (httpRequest == null || httpResponse == null) {
             throw new ComponentInitializationException("Servlet request and response must be set");
+        } else if (!secure || !httpOnly) {
+            log.warn("Use of secure and httpOnly properties are strongly advisable, currently one or both are false");
         }
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.