Wish B4J server set jsessionid cookie HttpOnly

billzhan · Aug 30, 2014

Hi Erel,

Set cookie (jsessionid) HttpOnly will prevent XSS attack.See http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

I hope this feature can be added.

Thanks,
bz

Erel · Aug 31, 2014

You can set HttpOnly with this code:

B4X:

Dim jo As JavaObject = srvr
   Dim sessionmanager As JavaObject = _
     jo.GetFieldJO("context").RunMethodJO("getSessionHandler", Null).RunMethod("getSessionManager", Null)
   sessionmanager.RunMethod("setHttpOnly", Array(True))

Run it after you call Server.Start.

I tested this code with FireBug:

billzhan · Aug 31, 2014

It works here. Thanks

Wish B4J server set jsessionid cookie HttpOnly

billzhan

Active Member

Erel

B4X founder

billzhan

Active Member

Wish B4J server set jsessionid cookie HttpOnly

billzhan

Active Member

Erel

B4X founder

billzhan

Active Member

Privacy & Transparency

Privacy & Transparency