send cookies via secure channel

https://github.com/eclipse-platform/eclipse.platform/security/code-scanning/24
eclipse-platform · Sep 19, 2023 · 06d9d3e · 06d9d3e
1 parent 00e8ea7
commit 06d9d3e
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 0 deletions.
diff --git a/ua/org.eclipse.help.webapp/advanced/index.jsp b/ua/org.eclipse.help.webapp/advanced/index.jsp
@@ -19,6 +19,7 @@
 	if(data.getMode() == LayoutData.MODE_INFOCENTER){
 		Cookie cookieTest=new Cookie("cookiesEnabled", "yes");
 		cookieTest.setMaxAge(365*24*60*60);
+		cookieTest.setSecure(true);
 		response.addCookie(cookieTest);
 	}
 %>

diff --git a/ua/org.eclipse.help.webapp/src/org/eclipse/help/internal/webapp/data/UrlUtil.java b/ua/org.eclipse.help.webapp/src/org/eclipse/help/internal/webapp/data/UrlUtil.java
@@ -574,6 +574,7 @@ private static String getForcedLocale(HttpServletRequest request,
 			// save locale (in session cookie) for later use in a user session
 			if (response != null) {
 				Cookie cookieTest = new Cookie("lang", forcedLocale); //$NON-NLS-1$
+				cookieTest.setSecure(true);
 				response.addCookie(cookieTest);
 			}
 		} else {

diff --git a/ua/org.eclipse.help.webapp/src/org/eclipse/help/internal/webapp/servlet/CookieUtil.java b/ua/org.eclipse.help.webapp/src/org/eclipse/help/internal/webapp/servlet/CookieUtil.java
@@ -65,6 +65,7 @@ public static void setCookieValue(String name, String value,
 		if ( needsCookiePath(request)) {
 			cookie.setPath(getCookiePath(request)); // Only set path if necessary
 		}
+		cookie.setSecure(true);
 		response.addCookie(cookie);
 		if (HelpWebappPlugin.DEBUG_WORKINGSETS) {
 			System.out
@@ -77,6 +78,7 @@ public static void setCookieValueWithoutPath(String name, String value,
 		Cookie cookie = new Cookie(name, value);
 		cookie.setMaxAge(COOKIE_LIFE);
 
+		cookie.setSecure(true);
 		response.addCookie(cookie);
 		if (HelpWebappPlugin.DEBUG_WORKINGSETS) {
 			System.out
@@ -109,6 +111,7 @@ protected static void deleteCookieUsingPath(String name, HttpServletRequest requ
 			cookie.setPath(cookiePath);
 		}
 		cookie.setMaxAge(0);
+		cookie.setSecure(true);
 		response.addCookie(cookie);
 	}