From 7a282fb67e171ef5fa27e9ec24f8bc06cbb62f33 Mon Sep 17 00:00:00 2001 From: Naoki Takezoe Date: Mon, 12 Sep 2016 15:06:59 +0900 Subject: [PATCH] (refs #1291)Add secure attribute to JSESSIONID cookie when baseUrl starts with "https://" --- src/main/scala/ScalatraBootstrap.scala | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/src/main/scala/ScalatraBootstrap.scala b/src/main/scala/ScalatraBootstrap.scala index fbb488a55..623fded9b 100644 --- a/src/main/scala/ScalatraBootstrap.scala +++ b/src/main/scala/ScalatraBootstrap.scala @@ -1,17 +1,23 @@ import gitbucket.core.controller._ import gitbucket.core.plugin.PluginRegistry -import gitbucket.core.servlet.{ApiAuthenticationFilter, GitAuthenticationFilter, Database, TransactionFilter} +import gitbucket.core.servlet.{ApiAuthenticationFilter, Database, GitAuthenticationFilter, TransactionFilter} import gitbucket.core.util.Directory - import java.util.EnumSet import javax.servlet._ +import gitbucket.core.service.SystemSettingsService import org.scalatra._ -class ScalatraBootstrap extends LifeCycle { +class ScalatraBootstrap extends LifeCycle with SystemSettingsService { override def init(context: ServletContext) { + + val settings = loadSystemSettings() + if(settings.baseUrl.exists(_.startsWith("https://"))) { + context.getSessionCookieConfig.setSecure(true) + } + // Register TransactionFilter and BasicAuthenticationFilter at first context.addFilter("transactionFilter", new TransactionFilter) context.getFilterRegistration("transactionFilter").addMappingForUrlPatterns(EnumSet.allOf(classOf[DispatcherType]), true, "/*")