[JIRA] (IDP-1872) Use __Host- prefix cookie names to ensure cookies come from the host

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1872 ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiMGI0OTBlN2QwZmU3NDc0ZDhlMTE1NGM1ZTI5MTEzZWQiLCJwIjoiaiJ9 )

Re: Use __Host- prefix cookie names to ensure cookies come from the host ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiMGI0OTBlN2QwZmU3NDc0ZDhlMTE1NGM1ZTI5MTEzZWQiLCJwIjoiaiJ9 )

I don’t accept this as some kind of best practice, we’re going to have to disagree on that. The cookie names are not going to be up for control. I understand the point that domain cookies are shared, but these are NOT domain cookies unless you make them so. That’s up to the settings you use.

I do agree that the default path property for the cookies is empty, that’s because we don’t really dictate that the context path be anything specific like /idp, even though that’s the norm. We leave that to the deployer. if you leave it empty, it’s empty. But the domain does default to empty as well, and should be causing them to be scoped to the host. If that’s not happening, then we definitely have a bug.

I checked the cookie in question and it is the same code handling it, one of our CookieManager beans that honors the properties in idp.properties for controlling all this.

( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiMGI0OTBlN2QwZmU3NDc0ZDhlMTE1NGM1ZTI5MTEzZWQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiMGI0OTBlN2QwZmU3NDc0ZDhlMTE1NGM1ZTI5MTEzZWQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:51e3c50 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/ebfc4425/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-053879d3-7993-48b2-abdb-7155dad820f9
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/ebfc4425/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-cdc6cbca-7ed9-451f-b9e0-b310c94c0b99
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/ebfc4425/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-6b6716e2-4a4d-4aaa-beee-ff5a057b6fec
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/ebfc4425/attachment-0005.png>