New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

https handling #7

Closed

syjer opened this issue Oct 9, 2014 · 1 comment

Assignees

Milestone

Member

syjer commented Oct 9, 2014

In production mode we should enforce https only mode.

with STS headers : http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security (we will need to check if request.isSecure() or request.getRequestURL starts with https:// OR if we the X-Forwarded-Proto header is present, that its https

force the cookies to be emitted as https only: onStartup of the Initializer ->

servletContext.setSessionTrackingModes(Collections.singleton(SessionTrackingMode.COOKIE));
servletContext.getSessionCookieConfig().setHttpOnly(true);

syjer added this to the 0.1 milestone

syjer self-assigned this

Member Author

syjer commented Oct 28, 2014

seems that the STS headers are set automagically by the proxy. Less work for me.

syjer closed this as completed in

c261a37

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment