From 75261ddb44ed87e0ee8e453ec3c281555107894e Mon Sep 17 00:00:00 2001 From: Wei Zhou Date: Thu, 5 Dec 2024 10:51:13 +0100 Subject: [PATCH] SAML2: add cookie with HttpOnly too #10013 --- .../src/main/java/org/apache/cloudstack/saml/SAMLUtils.java | 1 + 1 file changed, 1 insertion(+) diff --git a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java index 443091445b1c..fd68e2be1ae9 100644 --- a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java +++ b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java @@ -320,6 +320,7 @@ public static void setupSamlUserCookies(final LoginCmdResponse loginResponse, fi String sessionKeyCookie = String.format("%s=%s;Domain=%s;Path=%s;%s", ApiConstants.SESSIONKEY, loginResponse.getSessionKey(), domain, path, sameSite); s_logger.debug("Adding sessionkey cookie to response: " + sessionKeyCookie); resp.addHeader("SET-COOKIE", sessionKeyCookie); + resp.addHeader("SET-COOKIE", String.format("%s=%s;HttpOnly;Path=/client/api;%s", ApiConstants.SESSIONKEY, loginResponse.getSessionKey(), sameSite)); } /**