You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@sling.apache.org by "Carsten Ziegeler (Jira)" <ji...@apache.org> on 2021/04/12 06:49:00 UTC

[jira] [Resolved] (SLING-10293) Sudo cookie - set httpOnly and secure

     [ https://issues.apache.org/jira/browse/SLING-10293?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Carsten Ziegeler resolved SLING-10293.
--------------------------------------
    Resolution: Fixed

Always set httpOnly and set secure if the current request is secure:

https://github.com/apache/sling-org-apache-sling-auth-core/commit/ef8c9d628bf9a9744cf0c30dd640b6afbe176681

> Sudo cookie - set httpOnly and secure
> -------------------------------------
>
>                 Key: SLING-10293
>                 URL: https://issues.apache.org/jira/browse/SLING-10293
>             Project: Sling
>          Issue Type: Improvement
>            Reporter: Carsten Ziegeler
>            Assignee: Carsten Ziegeler
>            Priority: Major
>             Fix For: Auth Core 1.5.2
>
>
> The sudo cookie is currently set without making it httpOnly or setting the secure flag



--
This message was sent by Atlassian Jira
(v8.3.4#803005)