Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-7095980

Ensure HttpURLConnection (and supporting APIs) don't expose HttpOnly cookies

    XMLWordPrintable

Details

    • Enhancement
    • Resolution: Fixed
    • P2
    • 8
    • 7
    • core-libs
    • None
    • b19
    • generic
    • generic
    • Verified

    Backports

      Description

        Once CR 7077220 is fixed the Plugin CookieHandler may be able to retrieve HttpOnly cookies from the browsers cookie store. This CR is concerned with ensuring HttpOnly cookies are not accessible to application code ( trusted or untrusted ).

        HttpOnly cookies should only be accessible to the HTTP client implementation, so that they can be used in HTTP requests, and NOT anywhere else.

        Attachments

          Issue Links

            backported by

            Backport - A issue that is required to port a Bug or Feature into another product release. This issue type is generally associated with the main Bug/Feature to represent each individual release of the port. JDK-2219511 Ensure HttpURLConnection (and supporting APIs) don't expose HttpOnly cookies

            • P2 - Crashes, loss of data, severe memory leak.
            • Closed
            duplicates

            Bug - A problem which impairs or prevents the functions of the product. JDK-8014034 Certain Set-Cookie lines in headers appear as null in recent versions of 1.7.0

            • P3 - Major loss of function.
            • Resolved
            relates to

            Bug - A problem which impairs or prevents the functions of the product. JDK-7128648 HttpURLConnection.getHeaderFields should return an unmodifiable Map

            • P2 - Crashes, loss of data, severe memory leak.
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. JDK-8036017 Set-Cookie response header is read as empty after setting CookieManager

            • P3 - Major loss of function.
            • Closed

            Enhancement - null JDK-7077220 Plugin CookieHandler ignores HttpOnly cookies

            • P3 - Major loss of function.
            • Closed

            Activity

              People

                chegar Chris Hegarty
                chegar Chris Hegarty
                Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:
                  Imported:
                  Indexed: