(cloudstack) branch 4.19 updated: SAML2: add cookie with HttpOnly too #10013 (#10047)

[dahn]

This is an automated email from the ASF dual-hosted git repository.

dahn pushed a commit to branch 4.19
in repository https://gitbox.apache.org/repos/asf/cloudstack.git


The following commit(s) were added to refs/heads/4.19 by this push:
     new f9b176744e6 SAML2: add cookie with HttpOnly too #10013 (#10047)
f9b176744e6 is described below

commit f9b176744e6a47837f6153b550a4117e9d453a45
Author: Wei Zhou <weiz...@apache.org>
AuthorDate: Mon Dec 9 16:45:21 2024 +0100

    SAML2: add cookie with HttpOnly too #10013 (#10047)
---
 .../saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java        | 1 +
 1 file changed, 1 insertion(+)

diff --git 
a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java
 
b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java
index 443091445b1..fd68e2be1ae 100644
--- 
a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java
+++ 
b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java
@@ -320,6 +320,7 @@ public class SAMLUtils {
         String sessionKeyCookie = String.format("%s=%s;Domain=%s;Path=%s;%s", 
ApiConstants.SESSIONKEY, loginResponse.getSessionKey(), domain, path, sameSite);
         s_logger.debug("Adding sessionkey cookie to response: " + 
sessionKeyCookie);
         resp.addHeader("SET-COOKIE", sessionKeyCookie);
+        resp.addHeader("SET-COOKIE", 
String.format("%s=%s;HttpOnly;Path=/client/api;%s", ApiConstants.SESSIONKEY, 
loginResponse.getSessionKey(), sameSite));
     }
 
     /**