[cpp-sp] branch main updated: SSPCPP-903 - Need stronger warning or change to cookieProps default

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=8d9c080cfbcb7793a824ecffc0053d81e4e07926

The following commit(s) were added to refs/heads/main by this push:
       new  8d9c080c  SSPCPP-903 - Need stronger warning or change to cookieProps default
8d9c080c is described below

commit 8d9c080cfbcb7793a824ecffc0053d81e4e07926
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Dec 1 11:56:30 2020 -0500

    SSPCPP-903 - Need stronger warning or change to cookieProps default
    
    https://issues.shibboleth.net/jira/browse/SSPCPP-903
---
 configs/shibboleth2.xml     | 10 +++++-----
 configs/win-shibboleth2.xml |  8 ++++----
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
index 001031bc..cbe08c07 100644
--- a/configs/shibboleth2.xml
+++ b/configs/shibboleth2.xml
@@ -18,12 +18,12 @@
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
         Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
         and should be a relative path, with the SP computing the full value based on the virtual
-        host. Using handlerSSL="true" will force the protocol to be https. You should also set
-        cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
-        "false", this makes an assertion stolen in transit easier for attackers to misuse.
+        host. Use of TLS is now assumed because browsers are enforcing it due to SameSite
+        restrictions. Note that while we default checkAddress to "false", this makes an assertion
+        stolen in transit easier for attackers to misuse.
         -->
-        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
-                  checkAddress="false" handlerSSL="false" cookieProps="http"
+       <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
+                  checkAddress="false" handlerSSL="true" cookieProps="https"
                   redirectLimit="exact">
 
             <!--
diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
index 50384ad9..de1f65be 100644
--- a/configs/win-shibboleth2.xml
+++ b/configs/win-shibboleth2.xml
@@ -67,12 +67,12 @@
         Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
         Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
         and should be a relative path, with the SP computing the full value based on the virtual
-        host. Using handlerSSL="true" will force the protocol to be https. You should also set
-        cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
-        "false", this makes an assertion stolen in transit easier for attackers to misuse.
+        host. Use of TLS is now assumed because browsers are enforcing it due to SameSite
+        restrictions. Note that while we default checkAddress to "false", this makes an assertion
+        stolen in transit easier for attackers to misuse.
         -->
         <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
-                  checkAddress="false" handlerSSL="false" cookieProps="http"
+                  checkAddress="false" handlerSSL="true" cookieProps="https"
                   redirectLimit="exact">
 
             <!--

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.