tapestry-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Martin Schneider (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (TAP5-2327) The Cookies interface should provide an option to mark cookies as httpOnly
Date Tue, 29 Apr 2014 09:29:16 GMT

     [ https://issues.apache.org/jira/browse/TAP5-2327?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Martin Schneider updated TAP5-2327:
-----------------------------------

    Description: Since Servlet 3.0 there is an option to mark cookies as httpOnly via javax.servlet.http.Cookie.setHttpOnly(boolean).
There should be an option to use that in org.apache.tapestry5.services.Cookies. In 5.3.7 the
default implementation does not set the httpOnly flag.  (was: Since Servlet 3.0 there is an
option to mark cookies as httpOnly via javax.servlet.http.Cookie.setHttpOnly(boolean). There
should be an option to use that in org.apache.tapestry5.services.Cookies. In 5.3.7 the default
implementation ignores the httpOnly flag.)

> The Cookies interface should provide an option to mark cookies as httpOnly
> --------------------------------------------------------------------------
>
>                 Key: TAP5-2327
>                 URL: https://issues.apache.org/jira/browse/TAP5-2327
>             Project: Tapestry 5
>          Issue Type: New Feature
>          Components: tapestry-core
>    Affects Versions: 5.3.7
>            Reporter: Martin Schneider
>              Labels: security
>
> Since Servlet 3.0 there is an option to mark cookies as httpOnly via javax.servlet.http.Cookie.setHttpOnly(boolean).
There should be an option to use that in org.apache.tapestry5.services.Cookies. In 5.3.7 the
default implementation does not set the httpOnly flag.



--
This message was sent by Atlassian JIRA
(v6.2#6252)

Mime
View raw message