You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@myfaces.apache.org by lu...@apache.org on 2014/05/12 13:58:46 UTC

svn commit: r1593938 - /myfaces/core/trunk/shared/src/main/java/org/apache/myfaces/shared/context/flash/FlashImpl.java

Author: lu4242
Date: Mon May 12 11:58:46 2014
New Revision: 1593938

URL: http://svn.apache.org/r1593938
Log:
MYFACES-3639 The flash scope cookie is not HttpOnly (thanks to Paul Nicolucci for provide this patch)

Modified:
    myfaces/core/trunk/shared/src/main/java/org/apache/myfaces/shared/context/flash/FlashImpl.java

Modified: myfaces/core/trunk/shared/src/main/java/org/apache/myfaces/shared/context/flash/FlashImpl.java
URL: http://svn.apache.org/viewvc/myfaces/core/trunk/shared/src/main/java/org/apache/myfaces/shared/context/flash/FlashImpl.java?rev=1593938&r1=1593937&r2=1593938&view=diff
==============================================================================
--- myfaces/core/trunk/shared/src/main/java/org/apache/myfaces/shared/context/flash/FlashImpl.java (original)
+++ myfaces/core/trunk/shared/src/main/java/org/apache/myfaces/shared/context/flash/FlashImpl.java Mon May 12 11:58:46 2014
@@ -1065,6 +1065,7 @@ public class FlashImpl extends Flash
         cookie.setMaxAge(-1);
         cookie.setPath(_getCookiePath(externalContext));
         cookie.setSecure(externalContext.isSecure());
+        cookie.setHttpOnly(true);
 
         return cookie;
     }