'set Domain on cookie using spring security when login success

How can I set the property "domain" on the users cookie when the user has authenticated from spring?

Edit: id like to add domain=".mydomain.com" to cookie with id JSESSIONID

I dont want to deal with spring-session-core or the particular implementation of the session like redis, and Im not using spring-boot. What is the easiest way to do this?

I dont want to jump in the rabbit hole of redis if I can avoid it.

Edit: investigated if set_cookie can be modified in custom implementation of AuthenticationSuccessHandlerImpl that extends AbstractAuthenticationTargetUrlRequestHandler, but "set_cookie" isnt set until

response.sendRedirect(redirectUrl);

of DefaultRedirectStrategy implements RedirectStrategy, but the also isCommitted()==True so set_cookie cant be changed.

I varified this by implementing my redirect strategy:

    @Override
public void sendRedirect(HttpServletRequest request, HttpServletResponse response, java.lang.String url)
        throws IOException {
    LOGGER.info("sendRedirect cookie size: "+response.getHeaders(HttpHeaders.SET_COOKIE).size()+ " is commited:"+response.isCommitted());
    String redirectUrl = calculateRedirectUrl(request.getContextPath(), url);
    redirectUrl = response.encodeRedirectURL(redirectUrl);
    LOGGER.info("sendRedirect cookie size: "+response.getHeaders(HttpHeaders.SET_COOKIE).size()+ " is commited:"+response.isCommitted());

    response.sendRedirect(redirectUrl);
}

Looks like set_cookie is set in response.sendRedirect and is committed at the same time.



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source