[JIRA] (IDP-1872) Use __Host- prefix cookie names to ensure cookies come from the host

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1872 ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiNTIzMTMxMjEyMjUxNDljZGI0Zjk3M2RmNzExY2Q2ZmEiLCJwIjoiaiJ9 )

Re: Use __Host- prefix cookie names to ensure cookies come from the host ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiNTIzMTMxMjEyMjUxNDljZGI0Zjk3M2RmNzExY2Q2ZmEiLCJwIjoiaiJ9 )

Answered my own question, you’re talking about yet another GoonDoggle (my new word for Google Boondoggle), https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-cookie-prefixes

I…will have to think about it. I gave up trying to pretend I agreed with anything about the web a long time ago, but this looks like a fair amount of potential work, and I’m not sure we can do this for JSESSIONID without some ugly hacking around using filters. A case could be made that if you can’t do it for probably the most crucial cookie we have, it’s not buying much.

Now I understand what you meant about the path, you’re just referring to the potential downside because it requires the path be set to the root unlike now.

If we did this it would pretty clearly be handled by probably exposing control over the cookie names themselves and not trying to actually do this explicitly as a feature, i.e. basically what I did in the SP to some extent by using the supplied name as a prefix.

( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiNTIzMTMxMjEyMjUxNDljZGI0Zjk3M2RmNzExY2Q2ZmEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiNTIzMTMxMjEyMjUxNDljZGI0Zjk3M2RmNzExY2Q2ZmEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:51e3c50 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/041b03dd/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-b46279fa-8f40-4c6a-b232-7b755ee6ddfc
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/041b03dd/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-a8a00ebd-7759-4e56-85da-6b7171d86270
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/041b03dd/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-66025104-7b44-4a95-96d3-e966bc88dfe6
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/041b03dd/attachment-0005.png>