HTTP Only flag on Shibboleth IdP cookies

[Cantor, Scott]

On 4/7/14, 8:39 AM, "WULMS Alex" <Alex.WULMS at swift.com> wrote:

>Would it be possible to make a new configuration parameter in the IdP
>that when set to true, the IdP will set the HTTP Only flag on the cookies
>that it generates but when the flag is not set at all (for old
>deployments) or set to false, the IdP will not set the HTTP Only flag.

If you want to file a RFE in Jira, that's fine, but I would file it
against the SIDP project, because there are no current plans for feature
updates to V2.

FWIW, the Java servlet API didn't support the flag until the 3.0 spec, and
the V2 code is not based on that version.

-- Scott