<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Referring to a discussion from two years ago about IdP cookie protection (see <a href="http://shibboleth.1660669.n2.nabble.com/IdP-cookie-protection-td7311929.html">http://shibboleth.1660669.n2.nabble.com/IdP-cookie-protection-td7311929.html</a>):<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Would it be possible to make a new configuration parameter in the IdP that when set to true, the IdP will set the HTTP Only flag on the cookies that it generates but when the flag is not set at all (for old deployments) or set to false, the IdP will not set the HTTP Only flag.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It would offer a slightly better protection against XSS and the deployer can experiment for himself if it works with the container that the deployer uses.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks and kind regards,<o:p></o:p></p><p class=MsoNormal>Alex Wulms<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-fareast-language:EN-GB'>Alex Wulms</span></b><span style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-fareast-language:EN-GB'><br></span><span lang=EN-US style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-fareast-language:EN-GB'>SWIFT | </span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";mso-fareast-language:EN-GB'>Lead Developer / E-channel <br>Tel: +32 2 6553931<br><a href="http://www.swift.com/"><span style='color:blue'>www.swift.com</span></a><br><br></span><span style='font-size:8.0pt;font-family:"Arial","sans-serif";mso-fareast-language:EN-GB'>This e-mail and any attachments thereto may contain information which is confidential and/or proprietary and intended for the sole use of the recipient(s) named above. If you have received this e-mail in error, please immediately notify the sender and delete the mail. Thank you for your co-operation. SWIFT reserves the right to retain e-mail messages on its systems and, under circumstances permitted by applicable law, to monitor and intercept e-mail messages to and from its systems.</span><span style='mso-fareast-language:EN-GB'><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>