Disable URL Rewriting by default with Servlet 3.0 config

[ikeyat]

Description

In general, URL rewriting should be disabled for security reasons.
Spring security has option to disable it.
On the other hand, Servlet 3.0 introduced a configuration to disable URL rewriting in web.xml with following code. It's better to defense at lower layer if possible, so we should apply this to our blank project as default configurations.

<session-config>
    <cookie-config>
        <http-only>true</http-only>
        <!-- <secure>true</secure> -->
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

Secure attribute can be configured with <secure>true</secure>. But we had better avoid to define it.
The reason is that most enterprise applications decode/encode HTTPS on SSL accelerator, LB or HTTP server. In such cases, the Secure attribute affects and a browser ignores cookie when it is running without them. Application should be independent from infrastructures.

Possible Solutions

Add following config on web.xml.

<session-config>
    <cookie-config>
        <http-only>true</http-only>
        <!-- <secure>true</secure> -->
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

Affects Version/s

• 5.0.1.RELEASE
• 1.0.3.RELEASE

Fix Version/s

• 5.1.0.RELEASE
• 5.0.2.RELEASE

Issue Links

Reference Links

• https://jcp.org/aboutJava/communityprocess/final/jsr315/index.html

[making]

How about

<session-config>
    <cookie-config>
        <!-- <secure>true</secure> -->
        <http-only>true</http-only>
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

?

[ikeyat]

@making

It's better so I modified the possible solution.

[making]

👍