fixed all cookies should be HttpOnly since JS code does not read any …

…of them
Erudika · Jan 2, 2024 · cc6147e · cc6147e
1 parent 922106a
commit cc6147e
Show file tree

Hide file tree

Showing 5 changed files with 11 additions and 14 deletions.
diff --git a/src/main/java/com/erudika/scoold/controllers/LanguagesController.java b/src/main/java/com/erudika/scoold/controllers/LanguagesController.java
@@ -66,7 +66,7 @@ public String post(@PathVariable String langkey, HttpServletRequest req, HttpSer
 		Locale locale = utils.getCurrentLocale(langkey);
 		if (locale != null) {
 			int maxAge = 60 * 60 * 24 * 365;  //1 year
-			HttpUtils.setRawCookie(ScooldUtils.getConfig().localeCookie(), locale.toString(), req, res, false, "Strict", maxAge);
+			HttpUtils.setRawCookie(ScooldUtils.getConfig().localeCookie(), locale.toString(), req, res, "Strict", maxAge);
 		}
 		return "redirect:" + LANGUAGESLINK;
 	}

diff --git a/src/main/java/com/erudika/scoold/controllers/PeopleController.java b/src/main/java/com/erudika/scoold/controllers/PeopleController.java
@@ -167,7 +167,7 @@ public String applyFilter(@RequestParam(required = false) String sortby, @Reques
 				p.setSelect(spacesList);
 				savePagerToCookie(req, res, p);
 				HttpUtils.setRawCookie("users-view-compact", compactViewEnabled,
-						req, res, false, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
+						req, res, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
 			}
 		}
 		return "redirect:" + PEOPLELINK + (bulkedit ? "/bulk-edit" : "") + (StringUtils.isBlank(sortby) ? "" : "?sortby="
@@ -263,7 +263,7 @@ public String getName() {
 	private void savePagerToCookie(HttpServletRequest req, HttpServletResponse res, Pager p) {
 		try {
 			HttpUtils.setRawCookie("users-filter", Utils.base64enc(ParaObjectUtils.getJsonWriterNoIdent().
-					writeValueAsBytes(p)), req, res, false, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
+					writeValueAsBytes(p)), req, res, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
 		} catch (JsonProcessingException ex) { }
 	}
 

diff --git a/src/main/java/com/erudika/scoold/controllers/QuestionsController.java b/src/main/java/com/erudika/scoold/controllers/QuestionsController.java
@@ -184,7 +184,7 @@ public String applyFilter(@RequestParam(required = false) String sortby, @Reques
 			}
 			savePagerToCookie(req, res, p);
 			HttpUtils.setRawCookie("questions-view-compact", compactViewEnabled,
-					req, res, false, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
+					req, res, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
 		}
 		return "redirect:" + QUESTIONSLINK + (StringUtils.isBlank(sortby) ? "" : "?sortby="
 				+ Optional.ofNullable(StringUtils.trimToNull(sortby)).orElse(tab));
@@ -476,7 +476,7 @@ public String getName() {
 	private void savePagerToCookie(HttpServletRequest req, HttpServletResponse res, Pager p) {
 		try {
 			HttpUtils.setRawCookie("questions-filter", Utils.base64enc(ParaObjectUtils.getJsonWriterNoIdent().
-					writeValueAsBytes(p)), req, res, false, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
+					writeValueAsBytes(p)), req, res, "Strict", (int) TimeUnit.DAYS.toSeconds(365));
 		} catch (JsonProcessingException ex) { }
 	}
 

diff --git a/src/main/java/com/erudika/scoold/utils/HttpUtils.java b/src/main/java/com/erudika/scoold/utils/HttpUtils.java
@@ -125,7 +125,7 @@ public static void setStateParam(String name, String value, HttpServletRequest r
 	 */
 	public static void setStateParam(String name, String value, HttpServletRequest req,
 			HttpServletResponse res, boolean httpOnly) {
-		setRawCookie(name, value, req, res, httpOnly, null, -1);
+		setRawCookie(name, value, req, res, null, -1);
 	}
 
 	/**
@@ -146,7 +146,7 @@ public static String getStateParam(String name, HttpServletRequest req) {
 	 */
 	public static void removeStateParam(String name, HttpServletRequest req,
 			HttpServletResponse res) {
-		setRawCookie(name, "", req, res, false, null, 0);
+		setRawCookie(name, "", req, res, null, 0);
 	}
 
 	/**
@@ -155,12 +155,11 @@ public static void removeStateParam(String name, HttpServletRequest req,
 	 * @param value the value
 	 * @param req HTTP request
 	 * @param res HTTP response
-	 * @param httpOnly HTTP only flag
 	 * @param sameSite SameSite flag
 	 * @param maxAge max age
 	 */
 	public static void setRawCookie(String name, String value, HttpServletRequest req,
-			HttpServletResponse res, boolean httpOnly, String sameSite, int maxAge) {
+			HttpServletResponse res, String sameSite, int maxAge) {
 		if (StringUtils.isBlank(name) || value == null || req == null || res == null) {
 			return;
 		}
@@ -172,9 +171,7 @@ public static void setRawCookie(String name, String value, HttpServletRequest re
 		sb.append("Path=").append(path).append(";");
 		sb.append("Expires=").append(expires).append(";");
 		sb.append("Max-Age=").append(maxAge < 0 ? CONF.sessionTimeoutSec() : maxAge).append(";");
-		if (httpOnly) {
-			sb.append("HttpOnly;");
-		}
+		sb.append("HttpOnly;"); // all cookies should be HttpOnly, JS does not need to read cookie values
 		if (StringUtils.startsWithIgnoreCase(CONF.serverUrl(), "https://") || req.isSecure()) {
 			sb.append("Secure;");
 		}
@@ -274,7 +271,7 @@ public static void setAuthCookie(String jwt, HttpServletRequest req, HttpServlet
 		if (StringUtils.isBlank(jwt)) {
 			return;
 		}
-		setRawCookie(CONF.authCookie(), jwt, req, res, true, "Lax", CONF.sessionTimeoutSec());
+		setRawCookie(CONF.authCookie(), jwt, req, res, "Lax", CONF.sessionTimeoutSec());
 	}
 
 	/**

diff --git a/src/main/java/com/erudika/scoold/utils/ScooldUtils.java b/src/main/java/com/erudika/scoold/utils/ScooldUtils.java
@@ -1410,7 +1410,7 @@ public void storeSpaceIdInCookie(String space, HttpServletRequest req, HttpServl
 		// used for setting the space from a direct URL to a particular space
 		req.setAttribute(CONF.spaceCookie(), space);
 		HttpUtils.setRawCookie(CONF.spaceCookie(), Utils.base64encURL(space.getBytes()),
-				req, res, true, "Strict", StringUtils.isBlank(space) ? 0 : 365 * 24 * 60 * 60);
+				req, res, "Strict", StringUtils.isBlank(space) ? 0 : 365 * 24 * 60 * 60);
 	}
 
 	public String verifyExistingSpace(Profile authUser, String space) {