https://community.jforum.net/posts/list/2.page JForum - http://www.jforum.net
I performed a small PEN test on my installation of JForum and got a warning that the 'Secure' flag is missing (which is true):
[code]
Set-Cookie: jforumAutoLogin=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:10 GMT; Path=/; HttpOnly; SameSite=Strict
Set-Cookie: jforumUserId=1; Max-Age=31536000; Expires=Tue, 10 Mar 2026 19:26:29 GMT; Path=/; HttpOnly; SameSite=Strict
[/code]

I tried to force the inclusion of that flag through the 'session-config' in web.xml:
[code]
<session-config>
<session-timeout>10</session-timeout>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
</session-config>
[/code]

But for some strange reason it works for all 'Set-Cookie' headers except for jforum* cookies. Very strange.
Is there any other way to enforce inclusion of the 'Secure' flag through JForum? The headers are immutable in the HttpServletResponse class, so it can't be changed efterwards through a filter or something similar.

Thanks.

Regards,
Tommy

]]> https://community.jforum.net/posts/preList/297/1282.page https://community.jforum.net/posts/preList/297/1282.page GMT
[code=java]
cookie.setHttpOnly(true);
if (SystemGlobals.getValue(ConfigKeys.FORUM_LINK).startsWith("https"))
cookie.setSecure(true);
[/code]

but unless you want to recompile the source yourself, there is no external configuration you can apply to make this happen.]]> https://community.jforum.net/posts/preList/297/1283.page https://community.jforum.net/posts/preList/297/1283.page GMT Thanks.

Regards,
Tommy]]> https://community.jforum.net/posts/preList/297/1284.page https://community.jforum.net/posts/preList/297/1284.page GMT