Configure HttpOnly for language cookie and fix the cookie path. Fixes #…

…6151
geonetwork · Feb 22, 2022 · 657c69d · 657c69d
1 parent d7495a1
commit 657c69d
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/core/src/main/java/jeeves/server/sources/http/JeevesServlet.java b/core/src/main/java/jeeves/server/sources/http/JeevesServlet.java
@@ -206,7 +206,10 @@ private void execute(HttpServletRequest req, HttpServletResponse res) throws IOE
         langCookie.setMaxAge((int) TimeUnit.DAYS.toSeconds(7));
         langCookie.setComment("Keeps the last language chosen to be the preferred language");
         langCookie.setVersion(1);
-        langCookie.setPath("/");
+        langCookie.setPath(req.getContextPath());
+        langCookie.setHttpOnly(req.getServletContext().getSessionCookieConfig().isHttpOnly());
+        langCookie.setSecure(req.getServletContext().getSessionCookieConfig().isSecure());
+
         res.addCookie(langCookie);
 
         //--- execute request