HTTP Only flag on Shibboleth IdP cookies

[Cantor, Scott]

On 5/19/14, 8:06 AM, "WULMS Alex" <Alex.WULMS at swift.com> wrote:

>Should I file the RFE for HTTP Only flag against IDP project (IDP v3) or
>against SIDP project (IDP v2)?

IDP, because of this:

>FWIW, the Java servlet API didn't support the flag until the 3.0 spec, and
>the V2 code is not based on that version.

We don't code to non-standard APIs for things like cookies.

-- Scott