[OFBIZ-10286] JSESSIONID root cookie not protected (httponly)

• Type: Sub-task
• Status: Closed
• Priority: Minor
• Resolution: Cannot Reproduce
• Affects Version/s: Trunk
• Component/s: framework
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 16/Mar/18 10:50
• Updated: 22/Oct/18 10:06
• Resolved: 22/Oct/18 10:06

Description

I noticed OFBiz generate a JSESSIONID root cookie not protected (httponly)

I'm not sure yet how and why we create this cookie, and I'm also not sure it's a security issue but better to check all that and possibly remove this cookie generation