From bf38ec040f2e32da5446f35a58a9bb2e3162e068 Mon Sep 17 00:00:00 2001 From: Stian Thorgersen Date: Fri, 4 Mar 2016 13:42:46 +0100 Subject: [PATCH] KEYCLOAK-2592 Set http-only on OAuth_Token_Request_State cookie --- .../java/org/keycloak/adapters/OAuthRequestAuthenticator.java | 2 +- .../services/resources/AbstractSecuredLocalService.java | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java b/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java index 06830758fa..cf51bdf39e 100755 --- a/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java +++ b/adapters/oidc/adapter-core/src/main/java/org/keycloak/adapters/OAuthRequestAuthenticator.java @@ -206,7 +206,7 @@ public class OAuthRequestAuthenticator { tokenStore.saveRequest(); log.debug("Sending redirect to login page: " + redirect); exchange.getResponse().setStatus(302); - exchange.getResponse().setCookie(deployment.getStateCookieName(), state, /* need to set path? */ null, null, -1, deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr()), false); + exchange.getResponse().setCookie(deployment.getStateCookieName(), state, /* need to set path? */ null, null, -1, deployment.getSslRequired().isRequired(facade.getRequest().getRemoteAddr()), true); exchange.getResponse().setHeader("Location", redirect); return true; } diff --git a/services/src/main/java/org/keycloak/services/resources/AbstractSecuredLocalService.java b/services/src/main/java/org/keycloak/services/resources/AbstractSecuredLocalService.java index 45df9825b0..87bba2e3bb 100755 --- a/services/src/main/java/org/keycloak/services/resources/AbstractSecuredLocalService.java +++ b/services/src/main/java/org/keycloak/services/resources/AbstractSecuredLocalService.java @@ -247,8 +247,7 @@ public abstract class AbstractSecuredLocalService { URI url = uriBuilder.build(); - // todo httpOnly! - NewCookie cookie = new NewCookie(getStateCookieName(), state, getStateCookiePath(uriInfo), null, null, -1, isSecure); + NewCookie cookie = new NewCookie(getStateCookieName(), state, getStateCookiePath(uriInfo), null, null, -1, isSecure, true); logger.debug("NewCookie: " + cookie.toString()); logger.debug("Oauth Redirect to: " + url); return Response.status(302)