Rc release 4.2.1 #2329
Rc release 4.2.1 #2329
Conversation
Updated SQL insert statements to set 'iscomplex' to true for specific citation types in the dim_mappingkeys table.
…etadata converter
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| cookie.Domain = Request.Url.Host; // Set the domain | ||
| cookie.Path = "/"; // Set the path | ||
| cookieJwt.Expires = DateTime.Now.AddDays(1); // Expires in 1 day |
Check failure
Code scanning / CodeQL
Cookie security: persistent cookie
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 7 hours ago
In general, to avoid persistent cookies for sensitive data, you either (1) make them session cookies by not setting an Expires (or Max-Age), so the browser keeps them only in memory and deletes them when the browser closes, or (2) stop storing the sensitive data in a cookie at all and rely on server‑side session state. Here we can preserve existing behavior while improving security by turning the "jwt" cookie into a session cookie.
The minimal, non‑breaking fix in this snippet is to remove the explicit expiration, which is the only thing making the cookie persistent. In ASP.NET, if you do not set Expires, HttpCookie defaults to a session cookie. So in Console/BExIS.Web.Shell/Controllers/AccountController.cs, within the login action where the JWT cookie is created (around lines 303‑316), we should delete the line cookieJwt.Expires = DateTime.Now.AddDays(1);. No other functional change is required: the cookie will still be created with the same name, value, domain, and path, but will now only live as long as the browser session.
No new imports, helper methods, or additional definitions are needed; this is strictly a one‑line removal in the existing method.
| @@ -308,7 +308,6 @@ | ||
| HttpCookie cookieJwt = new HttpCookie("jwt", jwt); | ||
|
|
||
| // Set additional properties if needed | ||
| cookieJwt.Expires = DateTime.Now.AddDays(1); // Expires in 1 day | ||
| cookieJwt.Domain = Request.Url.Host; // Set the domain | ||
| cookieJwt.Path = "/"; // Set the path | ||
|
|
| cookieJwt.Expires = DateTime.Now.AddDays(1); // Expires in 1 day | ||
| cookieJwt.Domain = Request.Url.Host; // Set the domain | ||
| cookieJwt.Path = "/"; // Set the path |
Check failure
Code scanning / CodeQL
Cookie security: overly broad path
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 7 hours ago
In general, to fix an overly broad cookie path, set the cookie’s Path to the actual context path (or a narrower application sub-path) instead of /. This limits which HTTP requests will include the cookie and prevents other applications on the same domain from accessing it.
In this specific code, we should replace cookieJwt.Path = "/"; with a path that corresponds to the current application’s virtual directory (context path). In ASP.NET, Request.ApplicationPath returns the application’s root path (for example, /BExIS or / if deployed at domain root). Using Request.ApplicationPath (or the corresponding MVC helper in this controller) preserves existing functionality for this app but avoids exposing the cookie to sibling apps hosted under the same domain. No new methods or external libraries are required; we only need to change the assignment of the Path property on the HttpCookie.
Concretely: in Console/BExIS.Web.Shell/Controllers/AccountController.cs, in the region where cookieJwt is configured (lines around 305–315), change cookieJwt.Path = "/"; to cookieJwt.Path = Request.ApplicationPath;. This will ensure the cookie is only sent for requests under the same application root, while still working correctly for all routes within this app.
| @@ -310,7 +310,7 @@ | ||
| // Set additional properties if needed | ||
| cookieJwt.Expires = DateTime.Now.AddDays(1); // Expires in 1 day | ||
| cookieJwt.Domain = Request.Url.Host; // Set the domain | ||
| cookieJwt.Path = "/"; // Set the path | ||
| cookieJwt.Path = Request.ApplicationPath; // Restrict the cookie to this application's path | ||
|
|
||
| // Add the cookie to the response | ||
| Response.Cookies.Add(cookieJwt); |
| // Create a new cookie | ||
| HttpCookie cookie = new HttpCookie("jwt", jwt); | ||
| HttpCookie cookieJwt = new HttpCookie("jwt", jwt); |
Check warning
Code scanning / CodeQL
Cookie 'Secure' attribute is not set to true
No description provided.