Enabling the use of secure cookies causes failures with .NET / Java Open Client

When a web application is configured to use secure cookies (e.g. return the Secure attribute for an HTTP Cookie), then a .NET or Java Open Client application is unable to communicate with a PASOE instance anymore through the HTTP protocol.

Jan 17, 2023
Knowledge

Title

URL Name

Enabling-the-use-of-secure-cookies-causes-failures-with-NET-Java-Open-Client

Article Number

000228089

Environment

Product: OpenEdge Version: All supported versions OS: All supported platforms Other: PASOE, .NET Open Client, Java Open Client

Question/Problem Description

Steps to Reproduce

1) Create a new PASOE instance or use an existing one. 2) Add a <cookie-config> element to the conf/web.xml file in the <session-config> element. For example: <session-config> <session-timeout>30</session-timeout> <cookie-config> <http-only>true</http-only> <secure>true</secure> </cookie-config> <tracking-mode>COOKIE</tracking-mode> </session-config> 3) Add a simple .p into the conf/openedge folder. 4) Start the instance. 5) Connect to the instance using a .NET or Java Open Client application and run the .p on the PASOE instance.

Clarifying Information

This issue does not occur when using an ABL client through the APSV transport.

Error Message

From the PASOE Session Manager log: --- 2023-01-01T11:22:33.001-01:00 ERROR [thd-1] ROOT:a:00000003 c.p.appserv.adapters.apsv.Request - APSV(DB1BE4C91C17155B22031380B771B3B68C54AAFC7254.test) : unable to find existing HTTP session for specified sessionID. The session may have timed out. (18328) 2023-01-01T11:22:33.002-01:00 WARN [thd-1] ROOT:a:00000003 c.p.appserv.adapters.apsv.Request - APSV(DB1BE4C91C17155B22031380B771B3B68C54AAFC7254.test) : An error occurred processing the POST request : Unexpected error : com.progress.appserv.broker.exception.BrokerException$SessionNotFoundException: Session. (18320) From the .NET client: --- Progress.UBroker.Util.NetworkProtocolException: '9998' From the Java client: --- com.progress.ubroker.util.NetworkProtocolException: An AIA error was returned thru http : Unexpected error:An error was detected while executing the request. (9998) at com.progress.ubroker.client.ApacheClientInputStream.readMsg(ApacheClientInputStream.java:319) at com.progress.ubroker.client.BrokerSystem.readMsg(BrokerSystem.java:2556) at com.progress.ubroker.client.BrokerSystem.readPacket(BrokerSystem.java:2396) at com.progress.ubroker.client.BrokerSystem.read(BrokerSystem.java:1234) at com.progress.ubroker.client.BrokerSystem.read(BrokerSystem.java:1187) at com.progress.open4gl.dynamicapi.SinkInputStream.read(SinkInputStream.java:56) at com.progress.open4gl.dynamicapi.OutputParamReader.<init>(OutputParamReader.java:42) at com.progress.open4gl.dynamicapi.Session.runProcedure0(Session.java:884) ...

Defect Number

Enhancement Number

Cause

This is expected behavior. As documented in the web.xml, setting the 'secure' element to true will require the use of HTTPS.

    <!-- USER EDIT: uncomment the <session-config> element below to
         control these HTTP session run-time attributes. 

        <http-only> {true|false} Block cookie access to JavaScript
        <secure>    {true|false} Require HTTPS for transmitting cookie
        <tracking-mode> {COOKIE|URL|SSL} How session id communicated to client
        <session-timeout> {minutes}  How many minutes for a session to be 
                    idle before deletion
    -->
    
    <session-config>
        <session-timeout>30</session-timeout>
        <cookie-config>
            <http-only>true</http-only>
            <secure>true</secure>
        </cookie-config>
        <tracking-mode>COOKIE</tracking-mode>
    </session-config>

Some web browser will allow secure cookies through HTTP when using 'localhost' as the hostname. However, RFC 6265 states the following regarding the Secure attribute for Cookies:

4.1.2.5. The Secure Attribute
The Secure attribute limits the scope of the cookie to "secure" channels (where "secure" is defined by the user agent). When a cookie has the Secure attribute, the user agent will include the cookie in an HTTP request only if the request is transmitted over a secure channel (typically HTTP over Transport Layer Security (TLS) [RFC2818]).

So each software vendor can determine what falls under "secure channel". In this case, OpenEdge does not allow the use of localhost as a secure channel.

Resolution

It was determined that the Progress Product is functioning as designed.

An enhancement to the product can be requested through the Progress Community via an Ideas submission. Customer feedback is valuable and Idea submissions are monitored by our Product Management team. Enhancement requests are reviewed during the planning phase of each new product release and a list of the enhancements chosen for implementation can be found in the Release Notes documents that accompany each release. Once an Idea is submitted the Progress Software Community will have the opportunity to comment on and vote for the Idea.

For detailed information on how to submit an Idea, please refer to Article How to submit an enhancement request for a Progress product?.

Workaround

Notes

Progress Article(s):
How to disable HTTP in PASOE
PASOE (APSV transport): ABL client ignores the Secure attribute of an HTTP cookie

Keyword Phrase

Last Modified Date

1/17/2023 2:11 PM

Enabling the use of secure cookies causes failures with .NET / Java Open Client

Files(0)

Was this article helpful?

Was this article helpful?

Enabling the use of secure cookies causes failures with .NET / Java Open Client

Information

Related Articles