atl.xsrf.token HttpOnly set to true

[Catherine Aldrich]

How to set this to false.  We do not have a proxy in front of fisheye and httponly is set to true.  We are having multiple issues. 

[Jim Knepley - ReleaseTEAM]

Welcome to the community @Catherine Aldrich 

That is a Tomcat setting, so you must modify context.xml on the server(s).

ref: https://confluence.atlassian.com/jira064/preventing-security-attacks-720412500.html#PreventingSecurityAttacks-ConfiguringTomcattouseHttpOnlySessionIDCookies

[Catherine Aldrich]

We use apache-tomcat for Mercurial which is also on this server.  It does not server up the fisheye website.  Also, there is no context.xml .

Note this is fisheye/crucible, not Jira