2013-11-26 CAS AppSec Working Group Call
Meeting Details
Tuesday Nov 26. 14:00 - 15:00 US - Eastern (GMT -04:00)
Webex: https://emccorp.webex.com/emccorp/j.php?J=642289088
Webex has international dial-back capability
Passcode: 62405979
USA: 857-207-4204/888-643-3084
France: 0157323313/0805540147
Germany: 06950985552/08006646745
US Cell Link: tel://8572074204,62405979#
Meeting Number: 642 289 088
Meeting Password: This meeting does not require a password.
Participants
Agenda
- Review/Approve Meeting Minutes
- Review Action Items
- Open Discussion
Meeting Notes
Dynamic Scan results
- Make TGT to be secure and httpOnly: This can be done in CAS code.
- Make Session cookies secure and httpOnly: This is a container configuration. Add to "securing your CAS server" guide.
- Add http header X-FRAME-OPTIONS to avoid embedding. Either add to top.jsp or in the servlet.
- Avoid URL rewriting to include JSESSIONID in the URI. This is either a container option or servlet 3.0 config, but the serlvet spec method seems to turn that off when cookies are not enabled in the browser.
- Consider using the login page indicate the need to turn on cookies in the browser.
- Consider revving the CAS protocol doc to describe how CAS can do a post instead of a redirect with the tickets in a URI.
Action Items