[java-identity-provider] branch master updated: IDP-1223 - IdPv3 defaults to insecure cookies

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c3a59bc8f6b988c3b317564bac89fb7e0b9bf5b1

The following commit(s) were added to refs/heads/master by this push:
       new  c3a59bc   IDP-1223 - IdPv3 defaults to insecure cookies
c3a59bc is described below

commit c3a59bc8f6b988c3b317564bac89fb7e0b9bf5b1
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Jun 21 12:18:53 2019 -0400

    IDP-1223 - IdPv3 defaults to insecure cookies
    
    https://issues.shibboleth.net/jira/browse/IDP-1223
    
    Change secure default to true.
---
 idp-conf/src/main/resources/conf/idp.properties           | 3 +--
 idp-conf/src/main/resources/system/conf/global-system.xml | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 2baae46..2092083 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -19,8 +19,7 @@ idp.entityID = https://idp.example.org
 idp.scope = example.org
 
 # General cookie properties (maxAge only applies to persistent cookies)
-# Note the default for idp.cookie.secure, you will usually want it set.
-#idp.cookie.secure = false
+#idp.cookie.secure = true
 #idp.cookie.httpOnly = true
 #idp.cookie.domain =
 #idp.cookie.path =
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index fbc1b75..777e1bb 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -189,7 +189,7 @@
     <bean id="shibboleth.CookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
         p:httpServletRequest-ref="shibboleth.HttpServletRequest"
         p:httpServletResponse-ref="shibboleth.HttpServletResponse"
-        p:secure="%{idp.cookie.secure:false}"
+        p:secure="%{idp.cookie.secure:true}"
         p:httpOnly="%{idp.cookie.httpOnly:true}"
         p:cookieDomain="%{idp.cookie.domain:}"
         p:cookiePath="%{idp.cookie.path:}"
@@ -198,7 +198,7 @@
     <bean id="shibboleth.PersistentCookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
         p:httpServletRequest-ref="shibboleth.HttpServletRequest"
         p:httpServletResponse-ref="shibboleth.HttpServletResponse"
-        p:secure="%{idp.cookie.secure:false}"
+        p:secure="%{idp.cookie.secure:true}"
         p:httpOnly="%{idp.cookie.httpOnly:true}"
         p:cookieDomain="%{idp.cookie.domain:}"
         p:cookiePath="%{idp.cookie.path:}"
@@ -207,7 +207,7 @@
     <bean id="shibboleth.UserPrefsCookieManager" class="net.shibboleth.utilities.java.support.net.CookieManager"
         p:httpServletRequest-ref="shibboleth.HttpServletRequest"
         p:httpServletResponse-ref="shibboleth.HttpServletResponse"
-        p:secure="%{idp.cookie.secure:false}"
+        p:secure="%{idp.cookie.secure:true}"
         p:httpOnly="false"
         p:cookieDomain="%{idp.cookie.domain:}"
         p:cookiePath="%{idp.cookie.path:}"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.