Setting the Secure Flag on Cookies

This documentation is an older version of JasperReports Server Ultimate Guide. View the latest documentation.

To customize JasperReports Server so that cookies are sent only via secure connections:

For the time zone and locale cookies, open the following file to edit:

jasperserver-war-jarsrcmainjavacomjaspersoftjasperserverwarUserPreferencesFilter.java

Locate the following code in 2 locations, one for each cookie, and add the middle line to both:

For more information, see the JavaDoc for the setSecure method on the javax.servlet.http.Cookie class.

For the repository tree cookies, open the following file to edit:

jasperserver-warsrcmainwebappscriptstree.nanotree.js

Locate the following line in the setCookie function:

var secure = (argc > 5) ? argv[5] : false;

Replace the entire line with:

var secure = true;

For the UI settings cookies, open the following file to edit:

jasperserver-warsrcmainwebappscriptsutils.common.js

Locate the following line:

JSCookie.addVar('cookieTemplate', new Template('#{name}=#{value}; expires={expires}; path=/;'));

Modify the line as follows:

JSCookie.addVar('cookieTemplate', new Template('#{name}=#{value}; expires={expires}; path=/; secure;'));

Recompile, rebuild, and redeploy the JasperReports Server application.

This only acts on the cookies; providing a secure connection is up to the client application, usually by configuring and establishing an HTTPS connection, as described in Using SSL in the Web Server. If no secure connection is established, the cookies with the secure flag will not be sent and user settings won’t take effect.