X-Git-Url: https://gerrit.akraino.org/r/gitweb?a=blobdiff_plain;f=ui%2Fsrc%2Fmain%2Fwebapp%2FWEB-INF%2Fweb.xml;h=e65acccba2fb6defaed6af9c3d6381b4791cdb3a;hb=1459ff63baba295768ad703b2699fbfc509f7b34;hp=92a2d5926d24b55d95449745ac9863dd78da8976;hpb=34585c7411632c339ac147898e02f3ada118eb51;p=validation.git

diff --git a/ui/src/main/webapp/WEB-INF/web.xml b/ui/src/main/webapp/WEB-INF/web.xml
index 92a2d59..e65accc 100644
--- a/ui/src/main/webapp/WEB-INF/web.xml
+++ b/ui/src/main/webapp/WEB-INF/web.xml
@@ -12,7 +12,7 @@
     xmlns:web="http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
     version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee">
 
-    <display-name>AECBlueprintValidationUI</display-name>
+    <display-name>bluvalui</display-name>
 
     <!-- The app can function on a HA cluster -->
     <distributable />
@@ -20,6 +20,10 @@
     <session-config>
         <session-timeout>30</session-timeout>
         <tracking-mode>COOKIE</tracking-mode>
+        <cookie-config>
+            <http-only>true</http-only>
+            <secure>true</secure>
+        </cookie-config>
     </session-config>
     <filter>
         <filter-name>SecurityXssFilter</filter-name>
@@ -45,4 +49,26 @@
         <location>/WEB-INF/jsp/error.jsp</location>
     </error-page>
 
+     <!-- Require HTTPS for everything except /img (favicon) and /css. -->
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>HTTPSOnly</web-resource-name>
+            <url-pattern>/*</url-pattern>
+        </web-resource-collection>
+        <user-data-constraint>
+            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>HTTPSOrHTTP</web-resource-name>
+            <url-pattern>*.ico</url-pattern>
+            <url-pattern>/img/*</url-pattern>
+            <url-pattern>/css/*</url-pattern>
+        </web-resource-collection>
+        <user-data-constraint>
+            <transport-guarantee>NONE</transport-guarantee>
+        </user-data-constraint>
+    </security-constraint>
+
 </web-app>
\ No newline at end of file