HTTPOnly Cookies in Tomcat/JBoss

There are concerns that client side scripts should not be able to access the cookies sent by the server. Toward this, the HTTPOnly cookie was invented by Microsoft Internet Explorer and has been reasonably adopted by other browsers and the public.

Read more about it at the OWASP site: http://www.owasp.org/index.php/HTTPOnly

Tomcat has a flag on the Context element which you can either place it in WEB-INF/context.xml (JBoss) or META-INF/context.xml (Tomcat) to utilize this feature.

Reference: http://tomcat.apache.org/tomcat-6.0-doc/config/context.html

So look for examples of context.xml by google search and then add the "useHttpOnly=true" to the context element.

JBossXACML v2.0.4 Released

You can get JBossXACML v2.0.4 with minor performance improvements from
http://jboss.org/jbosssecurity/downloads/JBoss%20XACML/?action=a&windowstate=maximized

==================
** Feature Request
* [ SECURITY-423 ] RequestAttributeFactory should have method for multi valued attributes
* [ SECURITY-424 ] Schema Entity Resolver to resolve to local XACML schemas
* [ SECURITY-425 ] Ability to disable JBossXACML Schema Validation
* [ SECURITY-431 ] JAXBContext should be cached in JBossPDP

** Release
* [ SECURITY-432 ] Release JBossXACML 2.0.4
=====================

FAQ:
1) I want to use the latest JBossXACML jar in JBoss AS 5.x
- You need to replace the jbossxacml.jar with the one from this release from the lib directory of your JBoss AS instance. Note if you have a jboss-sunxacml.jar in the lib directory also, discard it.

JBoss Identity has OpenID Integration

I am pleased to announce the availability of JBoss Identity 1.0.0.alpha4 at http://jboss.org/jbossidentity/downloads/.

The significant feature addition is OpenID. More details are available at the OpenID Integration Wiki.

To become an OpenID Consumer(Relying Party), all you have to do is download the openid-consumer.war archive and deploy.