When we try to access localhost:4502, a cookie is created by the name cq-authoring-mode. Upon successful authentication a new cookie is created by the name login-token. both the cookies mentioned above are not secure. Can we do some modification in AEM that will make these cookies secure?
You can do similar like below
Using Apache Http Mod_Header rewrite setcooke header of authentication response.
Add this line of code to apache configuration:
Header edit Set-Cookie ^(login-token | cq-authoring-mode)$ $1;HttpOnly;Secure
Hi Arun, thanks for the response. we do not have apache setup on top of author. Author is accessible on 4502 port.
Also, there is one non prod AEM instance available that has a valid CA certificate. it is accessible over https. In one of the question asked here in the forum (AEM Session Cookie with httponly and secure flag ) it is mentioned that cookies are secure by default over https. On this instance too the cookies are not secured.
Am i missing something here??
I think we overlooked into this, there is a configuration to enable secure cookie
But just FYI/FYK
You can try to make cookies secure using filters, you can check with cookies are not secure then make it to secure using java
But If you want to make it over SSL, check below article-
Reference link 1: this only ensure the JSESSIONID cookie is made secure. And if it is made secure it will only be transferred over https and not on http. AEM needs to be enabled for SSL.
Reference link 2: Tried with DemoCookieFilter.java. I am making it secure: myCookie.setSecure(true); Now because AEM is not on https this cookie is not created. when i remove the above line, the cookie comes fine.
Reference link3: getting error while configuring ssl. Screenshot attached in response to other answer.
I tried creating self signed certificate using keytool and make the appropriate config in "Apache Felix Jetty based HTTP service". Checked the "enable HTTPS" mark and entered other relevant information and saved. I was able to access content on configured port (i used 5433 as port number) but chrome is marking it as unsecured.
And all cookies made secure using the filter class were not coming.
Thanks for your time.
I'll try filter code to make cookies secure and get back to you.
The Not secure warning comes when your certificates are not valid or trusted, because you used self signed certificate.
Quick question - did you manage to make cookies secure by enabling https?
If you follow the steps exactly, it would work fine. I've it running in my local w/o any issue.
What did you specify as hostname?
If you've specified a different hostname than localhost, make sure you've an entry in /etc/hosts or hosts file of WIN