Skip to content

Commit 4b3381f

Browse files
committed
Security: make CSRF cookie more secure
To fix the following warnings: 1. Error: Low: Sensitive data may be stored by the application in a cookie [com.miguno.migunos.filters.CustomCsrfFilter] At CustomCsrfFilter.java:[line 31] COOKIE_USAGE 2. Error: Medium: Cookie without the HttpOnly flag could be read by a malicious script in the browser [com.miguno.migunos.filters.CustomCsrfFilter] At CustomCsrfFilter.java:[line 32] HTTPONLY_COOKIE 3. Error: Medium: Cookie without the secure flag could be sent in clear text if an HTTP URL is visited [com.miguno.migunos.filters.CustomCsrfFilter] At CustomCsrfFilter.java:[line 32] INSECURE_COOKIE
1 parent db77aed commit 4b3381f

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

src/main/java/com/miguno/javadockerbuild/security/CustomCsrfFilter.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ protected void doFilterInternal(
2828
if (cookie == null || token != null && !token.equals(cookie.getValue())) {
2929
cookie = new Cookie(CSRF_COOKIE_NAME, token);
3030
cookie.setPath("/");
31+
cookie.setHttpOnly(true);
32+
cookie.setSecure(true);
3133
response.addCookie(cookie);
3234
}
3335
}

0 commit comments

Comments
 (0)