[HADOOP-11677] Add cookie flags for logs and static contexts

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.8.0, 3.0.0-alpha1
• Labels: BB2015-05-TBR
• Hadoop Flags: Reviewed
• Assignee: nijel
• Reporter: nijel
• Created: 05/Mar/15 09:57
• Updated: 30/Aug/16 01:30
• Resolved: 23/Nov/15 03:58

Description

In HTTPServer2.java for the default context the secure attributes are set.

SessionManager sm = webAppContext.getSessionHandler().getSessionManager();
    if (sm instanceof AbstractSessionManager) {
      AbstractSessionManager asm = (AbstractSessionManager)sm;
      asm.setHttpOnly(true);
      asm.setSecureCookies(true);
    }

But when the contexts are created for /logs and /static, new contexts are created and the session handler is assigned as null.

Here also the secure attributes needs to be set.

Is it not done intentionally ? please give your thought

Background
trying to add login action for HTTP pages. After this when security test tool is used, it reports error for these 2 urls (/logs and /static).