ZBUG-2341: Flag JSESSIONID httpOnly and secure

Zimbra · Oct 12, 2022 · 44cbb23 · 44cbb23
1 parent 56dc374
commit 44cbb23
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/conf/jetty/webdefault.xml b/conf/jetty/webdefault.xml
@@ -354,8 +354,13 @@
 
 
   <!-- ==================================================================== -->
+
   <session-config>
     <session-timeout>5</session-timeout>
+    <cookie-config>
+      <http-only>true</http-only>
+      <secure>true</secure>
+    </cookie-config>
   </session-config>
 
   <!-- ==================================================================== -->

diff --git a/conf/jetty/webdefault.xml.production b/conf/jetty/webdefault.xml.production
@@ -370,8 +370,13 @@
 
 
   <!-- ==================================================================== -->
+
   <session-config>
     <session-timeout>5</session-timeout>
+    <cookie-config>
+      <http-only>true</http-only>
+      <secure>true</secure>
+    </cookie-config>
   </session-config>
 
   <!-- ==================================================================== -->