JOSSO

I'm putting this issue in as a critical bug because I feel that it is relatively serious. The JOSSO SSO cookies created by HttpSSOAgent#newJossoCookie are not set to "secure" by default. This means that the cookie will be transported over ssl and non-ssl connections. The non-ssl transport is usually undesirable because it can be snooped. I've patched my JOSSO 1.7 org.josso.tc55.agent.SSOAgentValve like so:

457 cookie = _agent.newJossoCookie(request.getContextPath(), entry.ssoId);
458 if (request.isSecure()) cookie.setSecure(true);
459 hres.addCookie(cookie);

.. but I feel that the secure conditional check should probably be ported to the HttpSSOAgent#newJossoCookie method so it can apply to all Valves:

     public Cookie newJossoCookie(String path, String value, boolean secure) {

        // Some browsers don't like cookies without paths. This is useful for partner applications configured in the root context
        if (path == null || "".equals(path))
            path = "/";

        ssoCookie.setSecure(secure);

        Cookie ssoCookie = new Cookie(org.josso.gateway.Constants.JOSSO_SINGLE_SIGN_ON_COOKIE, value);
        ssoCookie.setMaxAge(-1);
        ssoCookie.setPath(path);

        // TODO : Check domain
        //ssoCookie.setDomain(cfg.getSessionTokenScope());

        return ssoCookie;
    }