Use secure session cookie

OpenConext · Oct 9, 2023 · 1a3c126 · 1a3c126
1 parent 4eb6662
commit 1a3c126
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/server/src/main/java/access/security/SecurityConfig.java b/server/src/main/java/access/security/SecurityConfig.java
@@ -28,6 +28,8 @@
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.savedrequest.DefaultSavedRequest;
+import org.springframework.session.web.http.CookieSerializer;
+import org.springframework.session.web.http.DefaultCookieSerializer;
 import org.springframework.web.context.request.RequestAttributes;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
@@ -114,6 +116,13 @@ public void addCorsMappings(CorsRegistry registry) {
         }
     }
 
+    @Bean
+    public CookieSerializer cookieSerializer() {
+        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
+        serializer.setUseSecureCookie(true);
+        return serializer;
+    }
+
     @Bean
     @Order(1)
     SecurityFilterChain sessionSecurityFilterChain(HttpSecurity http,

diff --git a/server/src/main/resources/application.yml b/server/src/main/resources/application.yml
@@ -12,6 +12,10 @@ server:
     path: "/error"
     include-message: always
   forward-headers-strategy: framework
+  servlet:
+    session:
+      cookie:
+        secure: true
 
 spring:
   main: