From 587df6a07aebd422495e3a4e833f258085a3fb05 Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Wed, 30 May 2018 12:23:40 -0700 Subject: [PATCH] Port call setHttpOnly property on Tomcat context Port "setHttpOnly on the TomcatContext" fix from commit 4d84933ee4 to 2.0.x. Since `Session` details are now configured on the `WebServerFactory` we can directly configure the context. See gh-12580 --- .../tomcat/TomcatServletWebServerFactory.java | 4 ++++ .../tomcat/TomcatServletWebServerFactoryTests.java | 11 +++++++++++ 2 files changed, 15 insertions(+) diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java index 6947f403c29..d69fbab7cc9 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java @@ -354,6 +354,10 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto private void configureSession(Context context) { long sessionTimeout = getSessionTimeoutInMinutes(); context.setSessionTimeout((int) sessionTimeout); + Boolean httpOnly = getSession().getCookie().getHttpOnly(); + if (httpOnly != null) { + context.setUseHttpOnly(httpOnly); + } if (getSession().isPersistent()) { Manager manager = context.getManager(); if (manager == null) { diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java index 761fd68ad51..562e55a3c35 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactoryTests.java @@ -420,6 +420,17 @@ public class TomcatServletWebServerFactoryTests assertThat(tldSkipSet).contains("foo.jar", "bar.jar"); } + @Test + public void customTomcatHttpOnlyCookie() { + TomcatServletWebServerFactory factory = getFactory(); + factory.getSession().getCookie().setHttpOnly(false); + this.webServer = factory.getWebServer(); + this.webServer.start(); + Tomcat tomcat = ((TomcatWebServer) this.webServer).getTomcat(); + Context context = (Context) tomcat.getHost().findChildren()[0]; + assertThat(context.getUseHttpOnly()).isFalse(); + } + @Override protected JspServlet getJspServlet() throws ServletException { Tomcat tomcat = ((TomcatWebServer) this.webServer).getTomcat();