[java-identity-provider] branch master updated: IDP-1476 - Need a filter to append SameSite to cookies

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4771a4367e2389919cab34eb6e93694eca65c7dc

The following commit(s) were added to refs/heads/master by this push:
       new  4771a43   IDP-1476 - Need a filter to append SameSite to cookies
4771a43 is described below

commit 4771a4367e2389919cab34eb6e93694eca65c7dc
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 10 13:55:11 2019 -0400

    IDP-1476 - Need a filter to append SameSite to cookies
    
    https://issues.shibboleth.net/jira/browse/IDP-1476
    
    Install Spring bean and filter for SameSite=None
---
 idp-conf/src/main/resources/system/conf/global-system.xml |  4 ++++
 idp-war/src/main/webapp/WEB-INF/web.xml                   | 15 +++++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index 424e6d5..9b1c659 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -177,6 +177,10 @@
         class="net.shibboleth.utilities.java.support.net.DynamicResponseHeaderFilter"
         p:headers="#{getObject('shibboleth.ResponseHeaderMap') ?: getObject('shibboleth.DefaultResponseHeaderMap')}"
         p:callbacks="#{getObject('shibboleth.ResponseHeaderCallbacks')}" />
+        
+    <bean id="shibboleth.SameSiteCookieFilter"
+        class="net.shibboleth.utilities.java.support.net.SameSiteCookieHeaderFilter"
+        p:defaultValue="None" />
 
     <bean id="shibboleth.BuilderFactory" factory-method="getBuilderFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
     <bean id="shibboleth.MarshallerFactory" factory-method="getMarshallerFactory" class="org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport" depends-on="shibboleth.OpenSAMLConfig" />
diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index d4d2e4d..160f600 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -27,6 +27,7 @@
     </listener>
     
     <!-- Filters and filter mappings -->
+    
     <!-- Try and force I18N, probably won't help much. -->
     <filter>
         <filter-name>CharacterEncodingFilter</filter-name>
@@ -40,6 +41,15 @@
             <param-value>true</param-value>
         </init-param>
     </filter>
+    <!-- Automates SameSite handling until Java API catches up. -->
+    <filter>
+        <filter-name>SameSiteCookieFilter</filter-name>
+        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
+        <init-param>
+            <param-name>targetBeanName</param-name>
+            <param-value>shibboleth.SameSiteCookieFilter</param-value>
+        </init-param>
+    </filter>
     <!-- Lets us lump repeated Set-Cookie headers into one, something containers rarely support. -->
     <filter>
         <filter-name>CookieBufferingFilter</filter-name>
@@ -64,6 +74,11 @@
         <filter-name>SLF4JMDCServletFilter</filter-name>
         <filter-class>net.shibboleth.idp.log.SLF4JMDCServletFilter</filter-class>
     </filter>
+    
+    <filter-mapping>
+        <filter-name>SameSiteCookieFilter</filter-name>
+        <url-pattern>/*</url-pattern>
+    </filter-mapping>
     <filter-mapping>
         <filter-name>CookieBufferingFilter</filter-name>
         <url-pattern>/profile/admin/*</url-pattern>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.