SAML2: add cookie with HttpOnly too apache#10013 (apache#10047)

weizhouapache · Dec 11, 2024 · a18f1a6 · a18f1a6
1 parent 1e10793
commit a18f1a6
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAMLUtils.java
@@ -321,6 +321,7 @@ public static void setupSamlUserCookies(final LoginCmdResponse loginResponse, fi
         String sessionKeyCookie = String.format("%s=%s;Domain=%s;Path=%s;%s", ApiConstants.SESSIONKEY, loginResponse.getSessionKey(), domain, path, sameSite);
         LOGGER.debug("Adding sessionkey cookie to response: " + sessionKeyCookie);
         resp.addHeader("SET-COOKIE", sessionKeyCookie);
+        resp.addHeader("SET-COOKIE", String.format("%s=%s;HttpOnly;Path=/client/api;%s", ApiConstants.SESSIONKEY, loginResponse.getSessionKey(), sameSite));
     }
 
     /**