Wish B4J server set jsessionid cookie HttpOnly

[billzhan]

Hi Erel,

Set cookie (jsessionid) HttpOnly will prevent XSS attack.See http://en.wikipedia.org/wiki/HTTP_cookie#Secure_and_HttpOnly

I hope this feature can be added.


Thanks,
bz

 

[Erel]

You can set HttpOnly with this code:

Dim jo As JavaObject = srvr
   Dim sessionmanager As JavaObject = _
     jo.GetFieldJO("context").RunMethodJO("getSessionHandler", Null).RunMethod("getSessionManager", Null)
   sessionmanager.RunMethod("setHttpOnly", Array(True))

Run it after you call Server.Start.

I tested this code with FireBug:

 

[billzhan]

It works here. Thanks