Setting HttpOnly and secure cookie flags in Liferay?

[Alireza Zare, geändert vor 11 Jahren.]

Does anyone know how to set HttpOnly and secure cookie flas in Liferay?

[Alireza Zare, geändert vor 11 Jahren.]

Can anyone confirm that one of the following methods will work for Liferay:

a. The httpOnly functionality can be enabled for all webapps in conf/context.xml:

<Context useHttpOnly="true">
...
</Context>

b. Writing a servlet filter to overwrite the session cookie:

private void rewriteCookieToHeader(HttpServletRequest request, HttpServletResponse response) {
if (response.containsHeader("SET-COOKIE")) {
String sessionid = request.getSession().getId();
String contextPath = request.getContextPath();
String secure = "";
if (request.isSecure()) {
secure = "; Secure";
}
response.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid
+ "; Path=" + contextPath + "; HttpOnly" + secure);
}
}

[Jason Roscoe, geändert vor 11 Jahren.]

I believe that will work for the JSESSIONID cookie, but how would we use this for ALL cookies that Liferay sets once a user logs in, like COMPANY_ID, ID, PASSWORD, REMEMBER_ME, LOGIN, SCREEN_NAME?

Thanks.

[Sushil Kumar Saini, geändert vor 11 Jahren.]

Hi Alireza,

I am using the option (a) to make the jsession id httpOnly it works fine. Didn't tried option 2.

Cheers
Sushil Saini

[Arun Pandian, geändert vor 8 Jahren.]

Where should i find the context.xml file..

[Thiago Leão Moreira, geändert vor 7 Jahren.]

Made the trick for me https://geekflare.com/secure-cookie-flag-in-tomcat/

[Thiago Leão Moreira, geändert vor 7 Jahren.]

This link also helped me out https://geekflare.com/httponly-secure-cookie-apache/

[Olaf Kock, geändert vor 7 Jahren.]

Thiago Leão Moreira:

Made the trick for me https://geekflare.com/secure-cookie-flag-in-tomcat/

I do object to the use of the secure-flag: It has other side effects: i.e. tomcat will assume that this connection is secure, no matter if it isn't: This implies that the administrator is responsible for making sure that indeed https is used for transport - for example on a reverse proxy. Without this, the use of this option is dangerous.