From e5b7e97ff445d4f5e3031b3b7cf136fc5e9f1bc5 Mon Sep 17 00:00:00 2001
From: zzz <zzz@mail.i2p>
Date: Wed, 8 Apr 2015 19:45:37 +0000
Subject: [PATCH] Jetty: Set session cookies to HttpOnly in all webapps
 i2psnark: Remove extra mime types in i2psnark web.xml; added to Jetty's
 default by now, or in our mime.properties file

---
 apps/addressbook/web.xml          |  7 ++++
 apps/i2psnark/web.xml             | 67 ++-----------------------------
 apps/i2ptunnel/jsp/web.xml        |  4 ++
 apps/routerconsole/jsp/web.xml    |  3 ++
 apps/susimail/src/WEB-INF/web.xml |  3 ++
 5 files changed, 21 insertions(+), 63 deletions(-)

diff --git a/apps/addressbook/web.xml b/apps/addressbook/web.xml
index 1aebb0d09..d86d32289 100644
--- a/apps/addressbook/web.xml
+++ b/apps/addressbook/web.xml
@@ -28,4 +28,11 @@
       <url-pattern>/*</url-pattern>
     </servlet-mapping>
 
+    <!-- this webapp doesn't actually use sessions or cookies -->
+    <session-config>
+        <session-timeout>30</session-timeout>
+        <cookie-config>
+            <http-only>true</http-only>
+        </cookie-config>
+    </session-config>
 </web-app>
diff --git a/apps/i2psnark/web.xml b/apps/i2psnark/web.xml
index 68e6abd64..d98f63733 100644
--- a/apps/i2psnark/web.xml
+++ b/apps/i2psnark/web.xml
@@ -26,73 +26,14 @@
       <url-pattern>/</url-pattern>
     </servlet-mapping>
     
+    <!-- this webapp doesn't actually use sessions or cookies -->
     <session-config>
         <session-timeout>
             30
         </session-timeout>
+        <cookie-config>
+            <http-only>true</http-only>
+        </cookie-config>
     </session-config>
 
-
-    <!-- mime types not in mime.properties in the jetty 5.1.15 source -->
-
-    <mime-mapping>
-        <extension>mkv</extension>
-        <mime-type>video/x-matroska</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>wmv</extension>
-        <mime-type>video/x-ms-wmv</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>flv</extension>
-        <mime-type>video/x-flv</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>mp4</extension>
-        <mime-type>video/mp4</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>rar</extension>
-        <mime-type>application/rar</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>7z</extension>
-        <mime-type>application/x-7z-compressed</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>iso</extension>
-        <mime-type>application/x-iso9660-image</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>ico</extension>
-        <mime-type>image/x-icon</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>exe</extension>
-        <mime-type>application/x-msdos-program</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>flac</extension>
-        <mime-type>audio/flac</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>m4a</extension>
-        <mime-type>audio/mpeg</mime-type>
-    </mime-mapping>
-
-    <mime-mapping>
-        <extension>wma</extension>
-        <mime-type>audio/x-ms-wma</mime-type>
-    </mime-mapping>
-
 </web-app>
diff --git a/apps/i2ptunnel/jsp/web.xml b/apps/i2ptunnel/jsp/web.xml
index 1fd11c13d..0a74b6835 100644
--- a/apps/i2ptunnel/jsp/web.xml
+++ b/apps/i2ptunnel/jsp/web.xml
@@ -32,10 +32,14 @@
         <url-pattern>/wizard</url-pattern>
     </servlet-mapping>
 
+    <!-- this webapp doesn't actually use sessions or cookies -->
     <session-config>
         <session-timeout>
             30
         </session-timeout>
+        <cookie-config>
+            <http-only>true</http-only>
+        </cookie-config>
     </session-config>
     <welcome-file-list>
         <welcome-file>index.html</welcome-file>
diff --git a/apps/routerconsole/jsp/web.xml b/apps/routerconsole/jsp/web.xml
index 67f0b4ca6..ea183c835 100644
--- a/apps/routerconsole/jsp/web.xml
+++ b/apps/routerconsole/jsp/web.xml
@@ -35,6 +35,9 @@
         <session-timeout>
             30
         </session-timeout>
+        <cookie-config>
+            <http-only>true</http-only>
+        </cookie-config>
     </session-config>
     <welcome-file-list>
         <welcome-file>index.html</welcome-file>
diff --git a/apps/susimail/src/WEB-INF/web.xml b/apps/susimail/src/WEB-INF/web.xml
index 23adde2d5..22f6e9b6f 100644
--- a/apps/susimail/src/WEB-INF/web.xml
+++ b/apps/susimail/src/WEB-INF/web.xml
@@ -23,6 +23,9 @@
   </servlet-mapping>
   <session-config>
     <session-timeout>1440</session-timeout>
+    <cookie-config>
+      <http-only>true</http-only>
+    </cookie-config>
   </session-config>
   <!-- tomcat (untested) -->
   <context-param>