Skip to main content
R
RaghavBR
Participant
February 8, 2013
Question

How to upgrade Servlet API in JRUN4

  • February 8, 2013
  • 1 reply
  • 755 views

I have the JRUN4 installation with IIS as web server. I want to apply the 'secure', 'httponly' flags to cookies for the applications which are running in the environment. we can have the secure and httponly cookie configurations in jrun-web.xml, but this approach impacts all the applications that are running in that environment.

By applying the secure, htttponly attributes in jrun-web.xml requires all the sites should be configured in SSL protocol.

In order to overcome this I have implemented a servlet filter ( using java servlet api), which sets the secure and httponly attributes to cookies. The filter implementation code we have a method response.getHeaders(). This method is not available in the servlet API version (2.3) that comes with JRUN4 and coldfusion. Due to this i am getting the below error after configuring this filter in web.xml.

I replaced the servet api jar file (servlet-api-2.5-6.0.0rc0) under the <JRun4-home>\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\etc with servlet API 3.0 jar but could not succeed.

Any information on how to upgrade the current servlet API implementation JRUN4 would be a great help.

    This topic has been closed for replies.

    1 reply

    pete_freitag
    pete_freitag
    Participating Frequently
    February 8, 2013

    You can't simply upgrade the servlet filter api in JRun because JRun needs to actually implement the new servlet API methods.   Your options are:

    1) to deploy to another servlet container (such as Tomcat, JBoss, etc) -- which requires a enterprise license

    2) Figure something out at the web server level

    3) Don't use J2EE sessions and use CF's sessions, then you can write the session cookies manually in onSessionStart (may not be an option if you need J2EE sessions)

    --

    Pete Freitag

    http://hackmycf.com/ - ColdFusion Server Security Scanner

    http://fuseguard.com/ - Web App Firewall for ColdFusion

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices