Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-6655

Add session tracking mode and make cookie secure

    XMLWordPrintableJSON

    Details

    • Sprint:
      Bug Crush Event - 21/2/2015

      Description

      Need to enhance security at web-app level.
      As per current implementation:

      • The cookie containing the session identifier is not secure
      • The session identifier is transmitted in the query string of the URL

      To fix these issue we have to add following session config otpions in web.xml

      <session-config>
      	<cookie-config>
      	    <http-only>true</http-only>
      	    <secure>true</secure>
      	</cookie-config>
      	<tracking-mode>COOKIE</tracking-mode>
      </session-config>
      

      Also we need to update the web-app servlet specification from 2.3 to 3.0

      <web-app version="3.0"
              xmlns="http://java.sun.com/xml/ns/javaee"
              xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
              xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
                                  http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd">
      

      https://tomcat.apache.org/whichversion.html

        Attachments

        1. sessionConifg_ecommerce.patch
          16 kB
          Rahul bhammarker
        2. OFBIA-6655.applications.patch
          73 kB
          Rahul bhammarker
        3. OFBIZ-6655.framework_themes.patch
          23 kB
          Rahul bhammarker
        4. OFBIZ-6655_specialpurpose_leftover.patch
          20 kB
          Rahul bhammarker
        5. OFBIZ-6655-programmatically-session-cookies-plugins.patch
          16 kB
          Jacques Le Roux
        6. OFBIZ-6655-programmatically-session-cookies-trunk.patch
          18 kB
          Jacques Le Roux
        7. OFBiz-6655.patch
          1 kB
          Deepak Nigam

          Issue Links

            Activity

              People

              • Assignee:
                jacques.le.roux Jacques Le Roux
                Reporter:
                deepak.dixit Deepak Dixit
              • Votes:
                0 Vote for this issue
                Watchers:
                8 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: