How to use <http-only> and <secure> tag are supported in Liferay

[10年前 に Girish kumar によって更新されました。]

Hi All,

We want to use below tags in web.xml in Jboss server:

<session-config>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>

By default Liferay 6120 supports the servlet spec 2.4 but the above tags are not supported in servlet spec 2.4.

Is With Liferay Portal 6.1.20 servelt 3.0 spec compliant because then only would be able to use above tags in web.xml


Env Details:
JBOSS Application Server:JBoss EAP 6.0.1.GA (AS 7.1.3.Final-redhat-4)
Liferay :Liferay Portal 6.1.20 (Paton / Build 6120 / July 31, 2012)


Thanks.

[10年前 に Girish kumar によって更新されました。]

Hi All,

Anybody is having idea on this query.

Thanks.

[8年前 に Suresh Yadagiri によって更新されました。]

We have same required. Did you find any solution?

[8年前 に David H Nebinger によって更新されました。]

No, the web.xml isn't used in portlets really. Whatever settings you have there don't really apply to the portlet.

[7年前 に Naresh Reddy Kallamadi によって更新されました。]

RE: How to use <http-only> and <secure> tag are supported in Liferay

[7年前 に Jorge Díaz によって更新されました。]

"HttpOnly" is activated by default since Liferay 7. See LPS-61285

For Liferay 6.2 you have to manually modify the web.xml file inside ROOT/WEB-INF and configure the session-config see Liferay 7 code: https://github.com/brianchandotcom/liferay-portal/pull/34327/files