[OFBIZ-6655] Add session tracking mode and make cookie secure

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 14.12.01, Trunk
• Fix Version/s: 14.12.01, 15.12.01, 17.12.01, 18.12.01
• Component/s: ALL COMPONENTS
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Deepak Dixit
• Created: 26/Sep/15 08:15
• Updated: 12/Jan/19 10:04
• Resolved: 12/Jan/19 10:02

Description

Need to enhance security at web-app level.
As per current implementation:

• The cookie containing the session identifier is not secure
• The session identifier is transmitted in the query string of the URL

To fix these issue we have to add following session config otpions in web.xml

<session-config>
	<cookie-config>
	    <http-only>true</http-only>
	    <secure>true</secure>
	</cookie-config>
	<tracking-mode>COOKIE</tracking-mode>
</session-config>

Also we need to update the web-app servlet specification from 2.3 to 3.0

<web-app version="3.0"
        xmlns="http://java.sun.com/xml/ns/javaee"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
                            http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">

https://tomcat.apache.org/whichversion.html

Issue Links

• is part of: OFBIZ-6766 Secure HTTP headers
• is related to: OFBIZ-6993 Cannot find the declaration of element 'web-app' in version 3.0 files.
• is related to: OFBIZ-6807 UtilXml.LocalResolver.resolveEntity] could not find LOCAL DTD/Schema with publicId [null] and the file/resource is [web-app_3_0.xsd]
• mentioned in: Page Loading...