Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Port call setHttpOnly property on Tomcat context

Browse Source 
Port "setHttpOnly on the TomcatContext" fix from commit 4d84933ee4 to
2.0.x. Since `Session` details are now configured on the
`WebServerFactory` we can directly configure the context.

See gh-12580
This commit is contained in:
Phillip Webb
2018-05-30 12:23:40 -07:00
parent e38d5f910b
commit 587df6a07a
2 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java
View File

@@ -354,6 +354,10 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto
private void configureSession(Context context) {
long sessionTimeout = getSessionTimeoutInMinutes();
context.setSessionTimeout((int) sessionTimeout);
Boolean httpOnly = getSession().getCookie().getHttpOnly();
if (httpOnly != null) {
context.setUseHttpOnly(httpOnly);
}
if (getSession().isPersistent()) {
Manager manager = context.getManager();
if (manager == null) {

11
spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java
View File

@@ -420,6 +420,17 @@ public class TomcatServletWebServerFactoryTests
assertThat(tldSkipSet).contains("foo.jar", "bar.jar");
}
@Test
public void customTomcatHttpOnlyCookie() {
TomcatServletWebServerFactory factory = getFactory();
factory.getSession().getCookie().setHttpOnly(false);
this.webServer = factory.getWebServer();
this.webServer.start();
Tomcat tomcat = ((TomcatWebServer) this.webServer).getTomcat();
Context context = (Context) tomcat.getHost().findChildren()[0];
assertThat(context.getUseHttpOnly()).isFalse();
}
@Override
protected JspServlet getJspServlet() throws ServletException {
Tomcat tomcat = ((TomcatWebServer) this.webServer).getTomcat();