JSESSIONID not "Secure"?

["richard@localmed.com" <ri...@localmed.com>]

Hi.

I noticed recently that the JSESSIONID cookie returned by Shiro does not
have the "Secure" attribute set.  For example, I see a response that
includes something like:
Set-Cookie: JSESSIONID=ad239d5c-34c4-49b0-a1d8-c6a5f21f32ae; Path=/;
HttpOnly

The "HttpOnly" attribute is set, but not "Secure", to require secure
transport.  (We are conducting all transport over https already.)  See
Section 4.1.2.5 after:
https://tools.ietf.org/html/rfc6265#section-4.1.2

How can I tell Shiro to include this attribute?  I did not see any obvious
way to specify this.

Thanks.




--
View this message in context: http://shiro-user.582556.n2.nabble.com/JSESSIONID-not-Secure-tp7579894.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: JSESSIONID not "Secure"?

[Brian Demers <br...@gmail.com>]

Also, take a look at this:
https://shiro.apache.org/web.html#Web-SessionCookieConfiguration

and set 'secure' = true


On Fri, Apr 25, 2014 at 3:22 PM, richard@localmed.com
<ri...@localmed.com>wrote:

> Ah, to answer my own question, it seems I can just extend
> DefaultWebSessionManager (which I already did for my project) and set the
> attribute on the cookie in the constructor.  Basically, I have:
>
>
> That was easy!
>
> I can see not wanting to set this by default, but it might make sense for
> Shiro to have a SecureWebSessionManager class that did this.
>
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/JSESSIONID-not-Secure-tp7579894p7579895.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>

Re: JSESSIONID not "Secure"?

["richard@localmed.com" <ri...@localmed.com>]

Ah, to answer my own question, it seems I can just extend
DefaultWebSessionManager (which I already did for my project) and set the
attribute on the cookie in the constructor.  Basically, I have:


That was easy!

I can see not wanting to set this by default, but it might make sense for
Shiro to have a SecureWebSessionManager class that did this.




--
View this message in context: http://shiro-user.582556.n2.nabble.com/JSESSIONID-not-Secure-tp7579894p7579895.html
Sent from the Shiro User mailing list archive at Nabble.com.