bugfix: make sure form resubmit cookie is secure

apache · Sep 21, 2023 · 6214edf · 6214edf
1 parent 62ef2b4
commit 6214edf
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupportCookies.java b/support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupportCookies.java
@@ -45,6 +45,7 @@ static void addCookie(@NonNull HttpServletResponse response, ServletContext serv
         var cookie = new Cookie(cokieName, cookieValue);
         cookie.setPath(servletContext.getContextPath());
         cookie.setMaxAge(maxAge);
+        cookie.setSecure(true);
         response.addCookie(cookie);
     }
 
@@ -53,6 +54,7 @@ static void deleteCookie(@NonNull HttpServletResponse response, ServletContext s
         var cookieToDelete = new Cookie(cokieName, "tbd");
         cookieToDelete.setPath(servletContext.getContextPath());
         cookieToDelete.setMaxAge(0);
+        cookie.setSecure(true);
         response.addCookie(cookieToDelete);
     }