{"action":"closed","issue":{"url":"https://api.github.com/repos/cloudfoundry/uaa/issues/774","repository_url":"https://api.github.com/repos/cloudfoundry/uaa","labels_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/774/labels{/name}","comments_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/774/comments","events_url":"https://api.github.com/repos/cloudfoundry/uaa/issues/774/events","html_url":"https://github.com/cloudfoundry/uaa/issues/774","id":296804999,"number":774,"title":"Account Cookies","user":{"login":"strehle","id":11627201,"avatar_url":"https://avatars2.githubusercontent.com/u/11627201?v=4","gravatar_id":"","url":"https://api.github.com/users/strehle","html_url":"https://github.com/strehle","followers_url":"https://api.github.com/users/strehle/followers","following_url":"https://api.github.com/users/strehle/following{/other_user}","gists_url":"https://api.github.com/users/strehle/gists{/gist_id}","starred_url":"https://api.github.com/users/strehle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/strehle/subscriptions","organizations_url":"https://api.github.com/users/strehle/orgs","repos_url":"https://api.github.com/users/strehle/repos","events_url":"https://api.github.com/users/strehle/events{/privacy}","received_events_url":"https://api.github.com/users/strehle/received_events","type":"User","site_admin":false},"labels":[{"id":240264515,"url":"https://api.github.com/repos/cloudfoundry/uaa/labels/unscheduled","name":"unscheduled","color":"D9D9D9","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-02-13T16:38:56Z","updated_at":"2018-02-13T19:16:50Z","closed_at":"2018-02-13T19:16:50Z","author_association":"CONTRIBUTOR","body":"**SECURITY NOTICE: If you have found a security problem in the UAA, please do not file a public github issue. Instead, please send an email to security@cloudfoundry.org**\r\n\r\nThanks for taking the time to file an issue. You'll minimize back and forth and help us help you more effectively by answering all of the following questions as specifically and completely as you can.\r\n\r\n### What version of UAA are you running?\r\n\r\n4.10.0\r\n\r\n### How are you deploying the UAA?\r\n\r\ngradlew\r\n\r\n### What did you do?\r\n\r\nLogon and checked received cookies.\r\n\r\n### What did you expect to see? What goal are you trying to achieve with the UAA?\r\n\r\nCookies with secure flags and httpOnly = true\r\n\r\n### What did you see instead?\r\n\r\nhttpOnly = false\r\n\r\n\r\n---------------\r\nThe cookie is sent out in\r\n\r\nhttps://github.com/cloudfoundry/uaa/blob/master/server/src/main/java/org/cloudfoundry/identity/uaa/login/AccountSavingAuthenticationSuccessHandler.java#L72-L77\r\n\r\nand used only if IdpDiscovery is active\r\n\r\nhttps://github.com/cloudfoundry/uaa/blob/master/server/src/main/java/org/cloudfoundry/identity/uaa/login/LoginInfoEndpoint.java#L473-L489\r\n\r\nTherefore the cookie should not be written in case IdpDiscovery is not active.\r\n\r\nProblem with the cookie is that there are personal information like an email and this information is stored for a year.\r\n"}}
{"actor":{"display_login":"jhamon"}}