Uploaded image for project: 'Crowd'
  1. Crowd
  2. CWD-1945

Make Crowd's cookie domain validation consistent with RFC 6265

    XMLWordPrintable

    Details

    • Type: Suggestion
    • Status: Closed (View Workflow)
    • Resolution: Fixed
    • Fix Version/s: 2.5
    • Component/s: None
    • Labels:
      None
    • Feedback Policy:

      Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      Description

      Currently Crowd allows admins to set a single sub-domain level only for the Cookie pattern.

      Example:
      URL Domain: abc.xyz.example.com
      SSO Domain Allowed: .xyz.example.com
      SSO Domain Not Allowed: .example.com (it would reach two sub-domain levels)

      If the browsers don't respect rfc2965, there is an opportunity to allow the definition of .example.com as the cookie pattern and support many subdomains for SSO.

      Currently the code defined at class SSOUtils blocks this behavior.

      • This problem is affecting Crowd 2.4.0

        Attachments

          Issue Links

          supersedes

          Suggestion - CWD-1938 Add an error message saying that '*' is not supported in the SSO Domain Pattern

          • Closed

            Activity

              People

              Assignee:
              jwalton joe
              Reporter:
              rbattaglin Renan Battaglin
              Votes:
              3 Vote for this issue
              Watchers:
              5 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: