How to use <http-only> and <secure> tag are supported in Liferay

[Girish kumar, modificado 10 Anos atrás.]

Hi All,

We want to use below tags in web.xml in Jboss server:

<session-config>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
<tracking-mode>COOKIE</tracking-mode>
</session-config>

By default Liferay 6120 supports the servlet spec 2.4 but the above tags are not supported in servlet spec 2.4.

Is With Liferay Portal 6.1.20 servelt 3.0 spec compliant because then only would be able to use above tags in web.xml


Env Details:
JBOSS Application Server:JBoss EAP 6.0.1.GA (AS 7.1.3.Final-redhat-4)
Liferay :Liferay Portal 6.1.20 (Paton / Build 6120 / July 31, 2012)


Thanks.

[Girish kumar, modificado 10 Anos atrás.]

Hi All,

Anybody is having idea on this query.

Thanks.

[Suresh Yadagiri, modificado 8 Anos atrás.]

We have same required. Did you find any solution?

[David H Nebinger, modificado 8 Anos atrás.]

No, the web.xml isn't used in portlets really. Whatever settings you have there don't really apply to the portlet.

[Naresh Reddy Kallamadi, modificado 7 Anos atrás.]

RE: How to use <http-only> and <secure> tag are supported in Liferay

[Jorge Díaz, modificado 7 Anos atrás.]

"HttpOnly" is activated by default since Liferay 7. See LPS-61285

For Liferay 6.2 you have to manually modify the web.xml file inside ROOT/WEB-INF and configure the session-config see Liferay 7 code: https://github.com/brianchandotcom/liferay-portal/pull/34327/files