KnowledgeHub
Questions
Tags
Users
Search
Alex Rivera
|
Logout
Edit Question
Title
Body
I am working on an XSS (cross site scripting) issue. My application runs on an Oracle Weblogic portal. We use Servlet version 2.5. I have added the below 3 lines of code in the filter for setting httponly and secure cookies, and it is working fine. String sessionid = req.getSession().getId(); res.setHeader("Set-Cookie", "JSESSIONID=" + sessionid + ";HttpOnly"); res.setHeader("SET-COOKIE", "JSESSIONID=" + sessionid + "; secure"); The issue is when I logout and login immediately in the same browser. I am able to login, but after that, on the jsp pages I am getting a session timeout issue. We use weblogic related apis. The request.getuserprinical() api is returning null.. guess it is setting to null. Please share any ideas. If there are any other ways to set httponly or secure flag, please help.
Tags (comma-separated)
Save Edits
Cancel