Cookie http-only setting has no effect when using Spring Session

[hellowenqi]

Hi, Cookie http-only setting has no effect when using spring boot 2.1.0.RELEASE.
I also tried the method of @wilkinsona in #12580!

Originally posted by @hellowenqi in #12580 (comment)

[wilkinsona]

@hellowenqi I cannot reproduce the behaviour you have described. With the following in application.properties:

server.servlet.session.cookie.http-only=false

The Set-Cookie header does not contain HttpOnly:

$ curl -i localhost:8080/hello
HTTP/1.1 200 
Set-Cookie: JSESSIONID=E81B3957963223C79740B7A6B709A943; Path=/
Content-Type: text/plain;charset=UTF-8
Content-Length: 5
Date: Fri, 09 Nov 2018 10:24:57 GMT

hello

If you would like us to spend some more time investigating, please take the time to provide a complete, minimal example (something that we can unzip or git clone) that reproduces the problem.

[hellowenqi]

Hi, @wilkinsona
this is my git repo: https://github.com/hellowenqi/HttpOnly.git

[wilkinsona]

Thanks for the sample. The key piece that you hadn't described in your original description is that you are using Spring Session. When you're using Spring Session, it's responsible for creating session cookies, not the underlying servlet container. This means that the problem fixed in #15139 isn't relevant.

I believe the behaviour you're seeing is due to Spring Session ignoring SessionCookieConfig.isHttpOnly() when it is configuring its cookie serializer.

[wilkinsona]

I was going to transfer this issue to spring-projects/spring-session but I am unable to do so (I don't quite understand when issues can and cannot be transferred). @hellowenqi Please open a Spring Session issue, referencing this one.