You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Biagi, Bill (Contractor)" <bi...@fanniemae.com> on 2007/10/04 18:03:56 UTC
setting secure cookie in Tomcat 5.0 config
How do you set Tomcat 5.0 to use secure cookies on an SSL session. Back
in 3.3 it was an attribute in server.xml of the SessionId module element
called secureCookie. Setting it to true used to mark the session id
cookie as "secure" if the session was established over SSL.
BB
This e-mail and its attachments are confidential and solely for the
intended addressee(s). Do not share or use them without Fannie Mae's
approval. If received in error, contact the sender and delete them.
RE: setting secure cookie in Tomcat 5.0 config
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Biagi, Bill (Contractor) [mailto:bill_biagi@fanniemae.com]
> Subject: RE: setting secure cookie in Tomcat 5.0 config
>
> I've got a set of Cisco load balancers doing the SSL so
> Tomcat does not know that these sessions are SSL.
>
> Is there any way to force Tomcat to set the jsessionid
> cookie to secure?
(I don't have the 5.0 source lying around anymore, so this is taken from
looking at 5.5.)
If you segregate requests that were originally SSL from those that
weren't via separate <Connector> elements in server.xml, then you can
set the secure attribute for the SSL one to "true". That should cause
sessions and cookies created under that <Connector> to be marked secure,
and doesn't appear to have other side effects.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: setting secure cookie in Tomcat 5.0 config
Posted by "Biagi, Bill (Contractor)" <bi...@fanniemae.com>.
I would turn on SSL in Tomcat for the traffic between the load balancers
and the Tomcat servers but it kind of defeats the purpose of using the
dedicated crypto engines in the load balancers.
BB
This e-mail and its attachments are confidential and solely for the
intended addressee(s). Do not share or use them without Fannie Mae's
approval. If received in error, contact the sender and delete them.
-----Original Message-----
From: Tim Funk [mailto:funkman@joedog.org]
Sent: Thursday, October 04, 2007 2:13 PM
To: Tomcat Users List
Subject: Re: setting secure cookie in Tomcat 5.0 config
Not really. The reason is its rather nonsensical for any webserver to
set a cookie as secure when the request is not secure.
-Tim
Biagi, Bill (Contractor) wrote:
> I've got a set of Cisco load balancers doing the SSL so Tomcat does
not
> know that these sessions are SSL. My guess is that is why it is not
> being set. Is there any way to force Tomcat to set the jsessionid
> cookie to secure?
>
> BB
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 1:38 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> You'll need to install fiddler to sniff when the cookie is being set.
If
>
> the request is SSL and during that request, the JSESSIONID cookie is
> created - it will be SSL. So either the cookie is being set some other
> time, or IE is lying that the cookie is secure. (Or something else)
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> The session is SSL and according to IE the jsessionid cookie is not
>> secure.
>>
>> BB
>>
>>
>>
>>
>> This e-mail and its attachments are confidential and solely for the
>> intended addressee(s). Do not share or use them without Fannie Mae's
>> approval. If received in error, contact the sender and delete them.
>>
>>
>> -----Original Message-----
>> From: Tim Funk [mailto:funkman@joedog.org]
>> Sent: Thursday, October 04, 2007 1:14 PM
>> To: Tomcat Users List
>> Subject: Re: setting secure cookie in Tomcat 5.0 config
>>
>> If you are talking about the JSESSIONID cookie - if the session is
>> created while your are using SSL - the secure flag is set for you.
>> Nothing to configure.
>>
>> -Tim
>>
>> Biagi, Bill (Contractor) wrote:
>>> How do you set Tomcat 5.0 to use secure cookies on an SSL session.
>> Back
>>> in 3.3 it was an attribute in server.xml of the SessionId module
>> element
>>> called secureCookie. Setting it to true used to mark the session id
>>> cookie as "secure" if the session was established over SSL.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: setting secure cookie in Tomcat 5.0 config
Posted by "Biagi, Bill (Contractor)" <bi...@fanniemae.com>.
Tim,
That did the trick. Thanks.
BB
This e-mail and its attachments are confidential and solely for the
intended addressee(s). Do not share or use them without Fannie Mae's
approval. If received in error, contact the sender and delete them.
-----Original Message-----
From: Tim Funk [mailto:funkman@joedog.org]
Sent: Friday, October 05, 2007 6:47 AM
To: Tomcat Users List
Subject: Re: setting secure cookie in Tomcat 5.0 config
In that case - this should do the trick:
http://tomcat.apache.org/tomcat-6.0-doc/config/http.html
<Connector secure="true" ...>
-Tim
Biagi, Bill (Contractor) wrote:
> The thing is it is actually secure. The Tomcat servers are behind the
> load balancers and using the dedicated hardware engines to perform the
> SSL. Granted Tomcat does not know this. This exact configuration is
> why it would make sense to be able to set the jsessionid to secure.
Why
> else would Tomcat have this setting in the server.xml back in version
> 3.3? I am assuming that there is no such override in 5.0 or later.
>
> BB
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 2:13 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> Not really. The reason is its rather nonsensical for any webserver to
> set a cookie as secure when the request is not secure.
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> I've got a set of Cisco load balancers doing the SSL so Tomcat does
> not
>> know that these sessions are SSL. My guess is that is why it is not
>> being set. Is there any way to force Tomcat to set the jsessionid
>> cookie to secure?
>>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: setting secure cookie in Tomcat 5.0 config
Posted by Tim Funk <fu...@joedog.org>.
In that case - this should do the trick:
http://tomcat.apache.org/tomcat-6.0-doc/config/http.html
<Connector secure="true" ...>
-Tim
Biagi, Bill (Contractor) wrote:
> The thing is it is actually secure. The Tomcat servers are behind the
> load balancers and using the dedicated hardware engines to perform the
> SSL. Granted Tomcat does not know this. This exact configuration is
> why it would make sense to be able to set the jsessionid to secure. Why
> else would Tomcat have this setting in the server.xml back in version
> 3.3? I am assuming that there is no such override in 5.0 or later.
>
> BB
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 2:13 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> Not really. The reason is its rather nonsensical for any webserver to
> set a cookie as secure when the request is not secure.
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> I've got a set of Cisco load balancers doing the SSL so Tomcat does
> not
>> know that these sessions are SSL. My guess is that is why it is not
>> being set. Is there any way to force Tomcat to set the jsessionid
>> cookie to secure?
>>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: setting secure cookie in Tomcat 5.0 config
Posted by "Biagi, Bill (Contractor)" <bi...@fanniemae.com>.
The thing is it is actually secure. The Tomcat servers are behind the
load balancers and using the dedicated hardware engines to perform the
SSL. Granted Tomcat does not know this. This exact configuration is
why it would make sense to be able to set the jsessionid to secure. Why
else would Tomcat have this setting in the server.xml back in version
3.3? I am assuming that there is no such override in 5.0 or later.
BB
This e-mail and its attachments are confidential and solely for the
intended addressee(s). Do not share or use them without Fannie Mae's
approval. If received in error, contact the sender and delete them.
-----Original Message-----
From: Tim Funk [mailto:funkman@joedog.org]
Sent: Thursday, October 04, 2007 2:13 PM
To: Tomcat Users List
Subject: Re: setting secure cookie in Tomcat 5.0 config
Not really. The reason is its rather nonsensical for any webserver to
set a cookie as secure when the request is not secure.
-Tim
Biagi, Bill (Contractor) wrote:
> I've got a set of Cisco load balancers doing the SSL so Tomcat does
not
> know that these sessions are SSL. My guess is that is why it is not
> being set. Is there any way to force Tomcat to set the jsessionid
> cookie to secure?
>
> BB
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 1:38 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> You'll need to install fiddler to sniff when the cookie is being set.
If
>
> the request is SSL and during that request, the JSESSIONID cookie is
> created - it will be SSL. So either the cookie is being set some other
> time, or IE is lying that the cookie is secure. (Or something else)
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> The session is SSL and according to IE the jsessionid cookie is not
>> secure.
>>
>> BB
>>
>>
>>
>>
>> This e-mail and its attachments are confidential and solely for the
>> intended addressee(s). Do not share or use them without Fannie Mae's
>> approval. If received in error, contact the sender and delete them.
>>
>>
>> -----Original Message-----
>> From: Tim Funk [mailto:funkman@joedog.org]
>> Sent: Thursday, October 04, 2007 1:14 PM
>> To: Tomcat Users List
>> Subject: Re: setting secure cookie in Tomcat 5.0 config
>>
>> If you are talking about the JSESSIONID cookie - if the session is
>> created while your are using SSL - the secure flag is set for you.
>> Nothing to configure.
>>
>> -Tim
>>
>> Biagi, Bill (Contractor) wrote:
>>> How do you set Tomcat 5.0 to use secure cookies on an SSL session.
>> Back
>>> in 3.3 it was an attribute in server.xml of the SessionId module
>> element
>>> called secureCookie. Setting it to true used to mark the session id
>>> cookie as "secure" if the session was established over SSL.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: setting secure cookie in Tomcat 5.0 config
Posted by Tim Funk <fu...@joedog.org>.
Not really. The reason is its rather nonsensical for any webserver to
set a cookie as secure when the request is not secure.
-Tim
Biagi, Bill (Contractor) wrote:
> I've got a set of Cisco load balancers doing the SSL so Tomcat does not
> know that these sessions are SSL. My guess is that is why it is not
> being set. Is there any way to force Tomcat to set the jsessionid
> cookie to secure?
>
> BB
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 1:38 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> You'll need to install fiddler to sniff when the cookie is being set. If
>
> the request is SSL and during that request, the JSESSIONID cookie is
> created - it will be SSL. So either the cookie is being set some other
> time, or IE is lying that the cookie is secure. (Or something else)
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> The session is SSL and according to IE the jsessionid cookie is not
>> secure.
>>
>> BB
>>
>>
>>
>>
>> This e-mail and its attachments are confidential and solely for the
>> intended addressee(s). Do not share or use them without Fannie Mae's
>> approval. If received in error, contact the sender and delete them.
>>
>>
>> -----Original Message-----
>> From: Tim Funk [mailto:funkman@joedog.org]
>> Sent: Thursday, October 04, 2007 1:14 PM
>> To: Tomcat Users List
>> Subject: Re: setting secure cookie in Tomcat 5.0 config
>>
>> If you are talking about the JSESSIONID cookie - if the session is
>> created while your are using SSL - the secure flag is set for you.
>> Nothing to configure.
>>
>> -Tim
>>
>> Biagi, Bill (Contractor) wrote:
>>> How do you set Tomcat 5.0 to use secure cookies on an SSL session.
>> Back
>>> in 3.3 it was an attribute in server.xml of the SessionId module
>> element
>>> called secureCookie. Setting it to true used to mark the session id
>>> cookie as "secure" if the session was established over SSL.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: setting secure cookie in Tomcat 5.0 config
Posted by "Biagi, Bill (Contractor)" <bi...@fanniemae.com>.
I've got a set of Cisco load balancers doing the SSL so Tomcat does not
know that these sessions are SSL. My guess is that is why it is not
being set. Is there any way to force Tomcat to set the jsessionid
cookie to secure?
BB
This e-mail and its attachments are confidential and solely for the
intended addressee(s). Do not share or use them without Fannie Mae's
approval. If received in error, contact the sender and delete them.
-----Original Message-----
From: Tim Funk [mailto:funkman@joedog.org]
Sent: Thursday, October 04, 2007 1:38 PM
To: Tomcat Users List
Subject: Re: setting secure cookie in Tomcat 5.0 config
You'll need to install fiddler to sniff when the cookie is being set. If
the request is SSL and during that request, the JSESSIONID cookie is
created - it will be SSL. So either the cookie is being set some other
time, or IE is lying that the cookie is secure. (Or something else)
-Tim
Biagi, Bill (Contractor) wrote:
> The session is SSL and according to IE the jsessionid cookie is not
> secure.
>
> BB
>
>
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 1:14 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> If you are talking about the JSESSIONID cookie - if the session is
> created while your are using SSL - the secure flag is set for you.
> Nothing to configure.
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> How do you set Tomcat 5.0 to use secure cookies on an SSL session.
> Back
>> in 3.3 it was an attribute in server.xml of the SessionId module
> element
>> called secureCookie. Setting it to true used to mark the session id
>> cookie as "secure" if the session was established over SSL.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: setting secure cookie in Tomcat 5.0 config
Posted by Tim Funk <fu...@joedog.org>.
You'll need to install fiddler to sniff when the cookie is being set. If
the request is SSL and during that request, the JSESSIONID cookie is
created - it will be SSL. So either the cookie is being set some other
time, or IE is lying that the cookie is secure. (Or something else)
-Tim
Biagi, Bill (Contractor) wrote:
> The session is SSL and according to IE the jsessionid cookie is not
> secure.
>
> BB
>
>
>
>
> This e-mail and its attachments are confidential and solely for the
> intended addressee(s). Do not share or use them without Fannie Mae's
> approval. If received in error, contact the sender and delete them.
>
>
> -----Original Message-----
> From: Tim Funk [mailto:funkman@joedog.org]
> Sent: Thursday, October 04, 2007 1:14 PM
> To: Tomcat Users List
> Subject: Re: setting secure cookie in Tomcat 5.0 config
>
> If you are talking about the JSESSIONID cookie - if the session is
> created while your are using SSL - the secure flag is set for you.
> Nothing to configure.
>
> -Tim
>
> Biagi, Bill (Contractor) wrote:
>> How do you set Tomcat 5.0 to use secure cookies on an SSL session.
> Back
>> in 3.3 it was an attribute in server.xml of the SessionId module
> element
>> called secureCookie. Setting it to true used to mark the session id
>> cookie as "secure" if the session was established over SSL.
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: setting secure cookie in Tomcat 5.0 config
Posted by "Biagi, Bill (Contractor)" <bi...@fanniemae.com>.
The session is SSL and according to IE the jsessionid cookie is not
secure.
BB
This e-mail and its attachments are confidential and solely for the
intended addressee(s). Do not share or use them without Fannie Mae's
approval. If received in error, contact the sender and delete them.
-----Original Message-----
From: Tim Funk [mailto:funkman@joedog.org]
Sent: Thursday, October 04, 2007 1:14 PM
To: Tomcat Users List
Subject: Re: setting secure cookie in Tomcat 5.0 config
If you are talking about the JSESSIONID cookie - if the session is
created while your are using SSL - the secure flag is set for you.
Nothing to configure.
-Tim
Biagi, Bill (Contractor) wrote:
> How do you set Tomcat 5.0 to use secure cookies on an SSL session.
Back
> in 3.3 it was an attribute in server.xml of the SessionId module
element
> called secureCookie. Setting it to true used to mark the session id
> cookie as "secure" if the session was established over SSL.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: setting secure cookie in Tomcat 5.0 config
Posted by Tim Funk <fu...@joedog.org>.
If you are talking about the JSESSIONID cookie - if the session is
created while your are using SSL - the secure flag is set for you.
Nothing to configure.
-Tim
Biagi, Bill (Contractor) wrote:
> How do you set Tomcat 5.0 to use secure cookies on an SSL session. Back
> in 3.3 it was an attribute in server.xml of the SessionId module element
> called secureCookie. Setting it to true used to mark the session id
> cookie as "secure" if the session was established over SSL.
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org