https://issues.shibboleth.net/jira/browse/SSPCPP-471

[shibboleth/sp.git] / configs / win-shibboleth2.xml

diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
index 68aa802..c795edf 100644 (file)
--- a/configs/win-shibboleth2.xml
+++ b/configs/win-shibboleth2.xml
@@ -71,11 +71,12 @@
         You MUST supply an effectively unique handlerURL value for each of your applications.
         The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing
         a relative value based on the virtual host. Using handlerSSL="true", the default, will force
-        the protocol to be https. You should also add a cookieProps setting of "; path=/; secure; HttpOnly"
-        in that case. Note that while we default checkAddress to "false", this has a negative
-        impact on the security of the SP. Stealing cookies/sessions is much easier with this disabled.
+        the protocol to be https. You should also set cookieProps to "https" for SSL-only sites.
+        Note that while we default checkAddress to "false", this has a negative impact on the
+        security of your site. Stealing sessions via cookie theft is much easier with this disabled.
         -->
-        <Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false">
+        <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
+                  checkAddress="false" handlerSSL="false" cookieProps="http">
 
             <!--
               Configures SSO for a default IdP. To allow for >1 IdP, remove
@@ -83,7 +84,7 @@
               (Set discoveryProtocol to "WAYF" for legacy Shibboleth WAYF support.)
               You can also override entityID on /Login query string, or in RequestMap/htaccess.
               -->
-            <SSO entityID="https://idp.example.org/shibboleth"
+            <SSO entityID="https://idp.example.org/idp/shibboleth"
                  discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
               SAML2 SAML1
             </SSO>