[java-identity-provider] branch master updated: IDP-1234 - Control Java servlet container session tracking

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=aaf1aa8b2a4164d16524cf5f910402de888e3622

The following commit(s) were added to refs/heads/master by this push:
       new  aaf1aa8   IDP-1234 - Control Java servlet container session tracking
aaf1aa8 is described below

commit aaf1aa8b2a4164d16524cf5f910402de888e3622
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jan 19 19:24:52 2018 -0500

    IDP-1234 - Control Java servlet container session tracking
    
    https://issues.shibboleth.net/jira/browse/IDP-1234
---
 idp-war/src/main/webapp/WEB-INF/web.xml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 1dbc8ba..4d9ff2a 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -152,6 +152,14 @@
         <location>/profile/RaiseError</location>
     </error-page>
 
+    <session-config>
+        <cookie-config>
+            <http-only>true</http-only>
+            <secure>true</secure>
+        </cookie-config>
+        <tracking-mode>COOKIE</tracking-mode>
+    </session-config>
+
     <!-- Block commonly flagged methods by using an empty auth-constraint. -->
     <security-constraint>
         <web-resource-collection>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.