[FELIX-5099] JSESSIONID Cookie in HTTPS Session Without 'Secure' and ‘HttpOnly’ Attributes

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: http.jetty-3.1.4
• Component/s: HTTP Service
• Assignee: David Bosschaert
• Reporter: Antonio Sanso
• Created: 13/Nov/15 08:00
• Updated: 29/Nov/15 14:51
• Resolved: 19/Nov/15 14:02

Description

The session Cookie JSESSIONID has not the attributes HttpOnly and Secure;

There is already a pull request to address the HttpOnly case in https://github.com/apache/felix/pull/12/files

Same approach can be used to address the secure flag