Project: Tomcat
Bug 49749 SSO cookie should be added as HttpOnly
Reported: 2010-08-13 19:18:22 | Status: resolved fixed

SSO cookies should be made HttpOnly by default. In org.apache.catalina.authenticator.AuthenticatorBase#register(), 798- response.addCookie(cookie); 798+ response.addCookieInternal(cookie, true);

Files changed in fix:
java/org/apache/catalina/authenticator/AuthenticatorBase.java