OpenSSO Enterprise session cookies can be marked as HTTPOnly (CR 6843487)

Patch 3 includes the new com.sun.identity.cookie.httponly property to allow OpenSSO Enterprise session cookies to be marked as HTTPOnly, in order to prevent scripts or third-party programs from accessing the cookies. Specifically, session cookies marked as HTTPOnly can help to prevent cross-site scripting (XSS) attacks.

By default, the value for com.sun.identity.cookie.httponly is false. To set this new property, use the OpenSSO Administration Console:

1. Log in to the OpenSSO Administration Console.

2. Click Configuration, Servers and Sites, opensso-instance-name, and then Advanced.

3. Add com.sun.identity.cookie.httponly with a value of true.

4. Click Save and log out of the Console.

5. Restart the OpenSSO Enterprise web container.

You also need to set this property on the client side. For example, for a Distributed Authentication UI server deployment, set it to true in the AMDistAuthConfig.properties file.