send cookies via secure channel

[jukzi]

https://github.com/eclipse-platform/eclipse.platform/security/code-scanning/24

[akurtakov]

Please verify that the help system still works with this change. The code and ideas there are pretty ancient so bigger changes might be needed (hopefully not) .

[github-actions]

Test Results

       42 files         42 suites   52m 55s ⏱️
  3 775 tests   3 772 ✔️   3 💤 0 ❌
11 328 runs  11 301 ✔️ 27 💤 0 ❌

Results for commit 06d9d3e.

[jukzi]

Please verify that the help system still works with this change. The code and ideas there are pretty ancient so bigger changes might be needed (hopefully not) .

The code is called in for example org.eclipse.ua.tests.help.search.InfocenterWorkingSetManagerTest.testIWSMWithTwoTopics() and the test does not fail. Does anybody have other ideas how to test? I don't even know where it is used in real live.

[iloveeclipse]

Does anybody have other ideas how to test? I don't even know where it is used in real live.

@howlger may know.

[howlger]

Does anybody have other ideas how to test? I don't even know where it is used in real live.

@howlger may know.

I don't know how to test this automatically. The following functions might be affected by the changes:

• Active help, e.g. in Help > Help Contents: Eclipse Platform User Guide > Getting started > Basic tutorial > The Workbench clicking the link "Help > Welcome" should do the same as selecting the menu Help > Welcome
• Persistence, e.g. a set search scope (with the link "Scope" to the right of the search field) should still be there after a restart
• Persistence in the Information Center, e.g. a set search scope should still be there after restarting the web browser

Ideally, this should be tested in different operating systems and with different web browsers.

[jukzi]

@howlger i do not understand how to test this before submitting it, as the webpage seems to be hosted on https://help.eclipse.org/

[howlger]

@howlger i do not understand how to test this before submitting it, as the webpage seems to be hosted on https://help.eclipse.org/

The so-called Information Center can be run as a plain, stand-alone Java application as described in the section How to start or stop information center from command line:

java -classpath d:\myApp\eclipse\plugins\org.eclipse.help.base_[version].jar org.eclipse.help.standalone.Infocenter -command start -eclipsehome d:\myApp\eclipse -port 8081

This will run the webpage locally at http://127.0.0.1:8081/help/index.jsp (similar to https://help.eclipse.org/ but with less content).

[jukzi]

I restarted both Infocenter and the webbrowser. After restart the scope is still the configured one:

so it seems to work. - even tough http://127.0.0.1:8081/help/index.jsp is not https.

[howlger]

Thanks for testing.

+1 for merging assuming active help also still works. It would be great to have this security improvement in M1.