Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-31852

[GSS](8.1.z) WFLY-19551 - Undertow subsystem is missing Servlet 6.0 support for cookie attributes

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Critical Critical
    • 8.1 Update 5
    • 8.1 Update 3, 8.1 Update 4
    • Undertow
    • None

      Servlet 6.0 added support for arbitrary cookie attributes [1], however, WildFly was never updated to support this.

      e.g.
      A valid web.xml containing the following currently throws a parser error:

      <web-app xmlns="https://jakarta.ee/xml/ns/jakartaee" version="6.0">
    <session-config>
        <cookie-config>
            <attribute>
                <attribute-name>SameSite</attribute-name>
                <attribute-value>None</attribute-value>
            </attribute>
        </cookie-config>
    </session-config>
</web-app>

      I'm filing this as a critical bug since this breaks compliance with the servlet specification. Apparently, the Servlet TCK was never updated to validate compliance for this new feature [2].

      [1] https://github.com/jakartaee/servlet/issues/175
      [2] https://github.com/jakartaee/servlet/pull/401

      To fix this, we need the following:

      1. A new release of jboss-metadata containing metadata/parser support
      2. A new release of Undertow, containing updates to io.undertow.servlet.api.ServletSessionConfig to support arbitrary cookie attributes.
      3. Changes the Undertow subsystem model/schema to support for arbitrary attributes within /undertow=subsystem/servlet-container=*/setting=session-cookie and affinity-cookie
      4. Changes to UndertowDeploymentInfoService to apply default cookie attributes from subsystem model and metadata to the ServletSessionConfig of the DeploymentInfo.

              rhn-cservice-bbaranow Bartosz Baranowski
              rhn-support-aogburn Aaron Ogburn
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: