Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-2938

Set Crowd JSESSIONID as HTTPOnly in the default configuration

XMLWordPrintable

      This is to improve mitigation of XSS vulnerabilities.

            [CWD-2938] Set Crowd JSESSIONID as HTTPOnly in the default configuration

            joe added a comment -

            For existing installations, the Crowd Context in apache-tomcat/conf/Catalina/localhost/crowd.xml needs to be edited from:

            <Context path="/crowd" docBase="../../crowd-webapp" debug="0">

            to

            <Context path="/crowd" docBase="../../crowd-webapp" debug="0" useHttpOnly="true">

            joe added a comment - For existing installations, the Crowd Context in apache-tomcat/conf/Catalina/localhost/crowd.xml needs to be edited from: <Context path= "/crowd" docBase= "../../crowd-webapp" debug= "0" > to <Context path= "/crowd" docBase= "../../crowd-webapp" debug= "0" useHttpOnly= " true " >

              jwalton joe
              vosipov VitalyA
              Affected customers:
              0 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: