Project: Tomcat
Bug 41217 SingleSignOn Cookie does not honor https access: Login Information Disclosure
Reported: 2006-12-20 05:13:27 | Status: resolved fixed

When using the SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. As the content of the SSO-Cookie is confidential (it will lead to automatically logged in sessions in other contexts - https or non-https) this should never happen. Sorry to have no patch. I've not installed the complete source distribution in my development environment, but it seems the points to change are org.apache.catalina.authenticator.AuthenticatorBase.register(...), the code of interest being (from 5.5.30 source distribution) Cookie cookie = new Cookie(Constants.SINGLE_SIGN_ON_COOKIE, ssoId); cookie.setMaxAge(-1); cookie.setPath("/"); hres.addCookie(cookie); As hres is an org.apache.catalina.HttpRequest, and I've looked through the code to find org.apache.catalina.Request.setSecure() but no ...isSecure() (though this is mentioned in the Javadoc for ...setSecure()) I suppose there needs to be another change to provide isSecure on Request or HttpRequest, but this is difficult to tell only from the editor. If isSecure() was there, there'd be a cookie.setSecure(hres.isSecure()) missing in the statements above...

Files changed in fix:
java/org/apache/catalina/authenticator/AuthenticatorBase.java