[java-support] branch master updated: Do not warn if HttpOnly is false

[Ian Young]

This is an automated email from the git hooks/post-receive script.

iay pushed a commit to branch master
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=15b3359ea0f86bae530b6402a74f7247f52485d0

The following commit(s) were added to refs/heads/master by this push:
       new  15b3359   Do not warn if HttpOnly is false
15b3359 is described below

commit 15b3359ea0f86bae530b6402a74f7247f52485d0
Author: Tom Zeller <tzeller at dragonacea.biz>
AuthorDate: Mon Oct 8 12:36:32 2018 -0500

    Do not warn if HttpOnly is false
    
    Since scripts (JavaScript) should be allowed to access cookies in some
    cases (user-prefs).
---
 .../java/net/shibboleth/utilities/java/support/net/CookieManager.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java b/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
index 16b880c..0b713ba 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/net/CookieManager.java
@@ -167,8 +167,8 @@ public final class CookieManager extends AbstractInitializableComponent {
         
         if (httpRequest == null || httpResponse == null) {
             throw new ComponentInitializationException("Servlet request and response must be set");
-        } else if (!secure || !httpOnly) {
-            log.warn("Use of secure and httpOnly properties are strongly advisable, currently one or both are false");
+        } else if (!secure) {
+            log.warn("Use of secure property is strongly advised");
         }
     }
 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.