Currently XUI is using JSON authentication resource that returns SSO token ID via JSON response. XUI then sets the token ID as cookie. This means that the cookie is not and can not be HttpOnly.
We want to support HttpOnly SSO session cookies. This means that the JSON endpoint needs to set the cookie and return empty tokenId (support for tokenId is necessary as presence of that property is being used as a flag for detecting successful authentication response).
Changes that needs to be implemented:
- setting cookie via
com.sun.identity.shared.encode.CookieUtils in org.forgerock.openam.core.rest.authn.http.AuthenticationServiceV?
- updating XUI to support empty
tokenId (it might be already present)
Currently XUI is using JSON authentication resource that returns SSO token ID via JSON response. XUI then sets the token ID as cookie. This means that the cookie is not and can not be HttpOnly.
We want to support HttpOnly SSO session cookies. This means that the JSON endpoint needs to set the cookie and return empty tokenId (support for tokenId is necessary as presence of that property is being used as a flag for detecting successful authentication response).
Changes that needs to be implemented:
com.sun.identity.shared.encode.CookieUtilsinorg.forgerock.openam.core.rest.authn.http.AuthenticationServiceV?tokenId(it might be already present)