Port fox for bug 41217. Set secure attribute on SSO cookie when cookie is created...

git-svn-id: https://svn.apache.org/repos/asf/tomcat/tc6.0.x/trunk@500626 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/java/org/apache/catalina/authenticator/AuthenticatorBase.java b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
index 572ec9f..2915a9d 100644 (file)
--- a/java/org/apache/catalina/authenticator/AuthenticatorBase.java
+++ b/java/org/apache/catalina/authenticator/AuthenticatorBase.java
@@ -743,6 +743,9 @@ public abstract class AuthenticatorBase
             cookie.setMaxAge(-1);
             cookie.setPath("/");
             
+            // Bugzilla 41217
+            cookie.setSecure(request.isSecure());
+
             // Bugzilla 34724
             String ssoDomain = sso.getCookieDomain();
             if(ssoDomain != null) {

diff --git a/webapps/docs/changelog.xml b/webapps/docs/changelog.xml
index 7bc662b..81fd38a 100644 (file)
--- a/webapps/docs/changelog.xml
+++ b/webapps/docs/changelog.xml
@@ -30,6 +30,11 @@
         Fix error messages when parsing context.xml that incorrectly referred to
         web.xml. (markt)
       </fix>
+      <fix>
+        <bug>41217</bug>: Set secure attribute on SSO cookie when cookie is
+        created during a secure request. Patch provided by Chris Halstead.
+        (markt)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Jasper">