HTTP Only flag on Shibboleth IdP cookies

[WULMS Alex]

Hi Scot,

Should I file the RFE for HTTP Only flag against IDP project (IDP v3) or
against SIDP project (IDP v2)?

Thanks and kind regards,
Alex

-----Original Message-----
Subject: Re: HTTP Only flag on Shibboleth IdP cookies

On 4/7/14, 8:39 AM, "WULMS Alex" <Alex.WULMS at swift.com> wrote:

>Would it be possible to make a new configuration parameter in the IdP 
>that when set to true, the IdP will set the HTTP Only flag on the 
>cookies that it generates but when the flag is not set at all (for old
>deployments) or set to false, the IdP will not set the HTTP Only flag.

If you want to file a RFE in Jira, that's fine, but I would file it against
the SIDP project, because there are no current plans for feature updates to
V2.

FWIW, the Java servlet API didn't support the flag until the 3.0 spec, and
the V2 code is not based on that version.

-- Scott

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4518 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/dev/attachments/20140519/a144e521/attachment.bin