You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2012/06/07 05:57:34 UTC
[Bug 53377] New: Cookie JSESSIONID is not secured
https://issues.apache.org/bugzilla/show_bug.cgi?id=53377
Priority: P2
Bug ID: 53377
Assignee: dev@tomcat.apache.org
Summary: Cookie JSESSIONID is not secured
Severity: major
Classification: Unclassified
OS: Linux
Reporter: chinoise_my@yahoo.com
Hardware: All
Status: NEW
Version: 5.5.33
Component: Connector:HTTP
Product: Tomcat 5
I happened to setup in tomcat
<Connector port="8443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" SSLEnabled="true"/>
But when i request https://MyURL
And from the firefox raw data, i still see JSESSION cookie is not secured.
There is no secure word at the the Set-Cookie
Set-Cookie: JSESSIONID=BAD4B8869D292DECECDA75863eCg; Path=/myApp
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 53377] Cookie JSESSIONID is not secured in HTTPS
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53377
Konstantin Kolinko <kn...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |INVALID
--- Comment #2 from Konstantin Kolinko <kn...@gmail.com> ---
WORKSFORME.
Using 5.5.33 from tomcat.apache.org
https://localhost:8443/servlets-examples/servlet/SessionExample
Firebug shows:
Set-Cookie JSESSIONID=B355639A382A19ADC04B164AD81CE37D;
Path=/servlets-examples; Secure
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 53377] Cookie JSESSIONID is not secured in HTTPS
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53377
--- Comment #1 from Konstantin Kolinko <kn...@gmail.com> ---
It is strange, because it should be working in 5.5.
I cannot see where it can fail.
For reference, in current 5.5.x (5.5.35):
request.secure flag is set in
o.a.catalina.connector.CoyoteAdapter#postParseRequest(..)
cookie.secure flag is set in
o.a.catalina.connector.Request#configureSessionCookie(..),
where it is copied from request.secure flag.
The cookie is formatted into response header in
o.a.tomcat.util.http.ServerCookie#appendCookieValue(..)
which is called from Response#addCookieInternal(...).
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 53377] Cookie JSESSIONID is not secured in HTTPS
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53377
Alex Lee <ch...@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |chinoise_my@yahoo.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 53377] Cookie JSESSIONID is not secured in HTTPS
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53377
Alex Lee <ch...@yahoo.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Cookie JSESSIONID is not |Cookie JSESSIONID is not
|secured |secured in HTTPS
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org