[JIRA] (IDP-1872) Use __Host- prefix cookie names to ensure cookies come from the host

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *commented* on IDP-1872 ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiMDE1NzQ0MDkxYTJmNGU4MGFjM2YzODBjOWU5MWJmOTciLCJwIjoiaiJ9 )

Re: Use __Host- prefix cookie names to ensure cookies come from the host ( https://shibboleth.atlassian.net/browse/IDP-1872?atlOrigin=eyJpIjoiMDE1NzQ0MDkxYTJmNGU4MGFjM2YzODBjOWU5MWJmOTciLCJwIjoiaiJ9 )

I’m not sure how well Jetty supports it, but it does look like you may be able to override name and path on the container cookie. If that’s true, then that would probably knock down my primary objection to doing the other work. I suppose in theory it shouldn’t be that hard, most of the names are either already properties or can be exposed as one, so apart from the SPNEGO case, perhaps not that difficult.

( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiMDE1NzQ0MDkxYTJmNGU4MGFjM2YzODBjOWU5MWJmOTciLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1872#add-comment?atlOrigin=eyJpIjoiMDE1NzQ0MDkxYTJmNGU4MGFjM2YzODBjOWU5MWJmOTciLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100183- sha1:51e3c50 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d057a405/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-e97dfe4d-2d01-4635-b675-5df701458e32
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d057a405/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-0d783454-ac2b-4dfd-abcd-2fa90ded5af2
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d057a405/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-276f55b9-a2f5-4b35-884f-495bef165427
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211022/d057a405/attachment-0005.png>