You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@accumulo.apache.org by ct...@apache.org on 2017/07/05 22:57:27 UTC
[3/7] accumulo git commit: ACCUMULO-4676 Use HTTPOnly flags in monitor
ACCUMULO-4676 Use HTTPOnly flags in monitor
Add missing HTTPOnly flags on the JSESSIONID cookie in Monitor UI
This prevents certain kinds of XSS attacks by preventing
well-implemented browsers from allowing client-side code to access and
modify the JSESSIONID cookie.
This closes #278
Signed-off-by: Christopher Tubbs <ct...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/accumulo/repo
Commit: http://git-wip-us.apache.org/repos/asf/accumulo/commit/9e7e3584
Tree: http://git-wip-us.apache.org/repos/asf/accumulo/tree/9e7e3584
Diff: http://git-wip-us.apache.org/repos/asf/accumulo/diff/9e7e3584
Branch: refs/heads/master
Commit: 9e7e35842722b45b7bce0b13833d3dab0925e443
Parents: 3d552ea
Author: Toshihiro Suzuki <br...@gmail.com>
Authored: Tue Jul 4 14:05:03 2017 +0900
Committer: Christopher Tubbs <ct...@apache.org>
Committed: Wed Jul 5 18:29:02 2017 -0400
----------------------------------------------------------------------
.../main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java | 2 ++
1 file changed, 2 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/accumulo/blob/9e7e3584/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
----------------------------------------------------------------------
diff --git a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
index f0213e7..d57b751 100644
--- a/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
+++ b/server/monitor/src/main/java/org/apache/accumulo/monitor/EmbeddedWebServer.java
@@ -82,6 +82,8 @@ public class EmbeddedWebServer {
connector.setPort(port);
handler = new ServletContextHandler(server, "/", new SessionHandler(), new ConstraintSecurityHandler(), null, null);
+ handler.getSessionHandler().getSessionManager().getSessionCookieConfig().setHttpOnly(true);
+
disableTrace("/");
}