[java-support] branch maint-7 updated: Do not warn if HttpOnly is false

[Tom Zeller]

This is an automated email from the git hooks/post-receive script.

tzeller pushed a commit to branch maint-7
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=cab1ca695916eec4499e8fe71494d693f20c0678

The following commit(s) were added to refs/heads/maint-7 by this push:
       new  cab1ca6   Do not warn if HttpOnly is false
cab1ca6 is described below

commit cab1ca695916eec4499e8fe71494d693f20c0678
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Mon Oct 8 12:36:32 2018 -0500

    Do not warn if HttpOnly is false
    
    Since scripts (JavaScript) should be allowed to access cookies in some
    cases (user-prefs).
---
 .../java/net/shibboleth/utilities/java/support/net/CookieManager.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java b/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
index 16b880c..0b713ba 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
@@ -167,8 +167,8 @@ public final class CookieManager extends AbstractInitializableComponent {
         
         if (httpRequest == null || httpResponse == null) {
             throw new ComponentInitializationException("Servlet request and response must be set");
-        } else if (!secure || !httpOnly) {
-            log.warn("Use of secure and httpOnly properties are strongly advisable, currently one or both are false");
+        } else if (!secure) {
+            log.warn("Use of secure property is strongly advised");
         }
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.