How to upgrade Servlet API in JRUN4

[RaghavBR]

I have the JRUN4 installation with IIS as web server. I want to apply the 'secure', 'httponly' flags to cookies for the applications which are running in the environment. we can have the secure and httponly cookie configurations in jrun-web.xml, but this approach impacts all the applications that are running in that environment.

By applying the secure, htttponly attributes in jrun-web.xml requires all the sites should be configured in SSL protocol.

In order to overcome this I have implemented a servlet filter ( using java servlet api), which sets the secure and httponly attributes to cookies. The filter implementation code we have a method response.getHeaders(). This method is not available in the servlet API version (2.3) that comes with JRUN4 and coldfusion. Due to this i am getting the below error after configuring this filter in web.xml.

I replaced the servet api jar file (servlet-api-2.5-6.0.0rc0) under the <JRun4-home>\servers\cfusion\cfusion-ear\cfusion-war\WEB-INF\cfusion\lib\etc with servlet API 3.0 jar but could not succeed.

Any information on how to upgrade the current servlet API implementation JRUN4 would be a great help.

[pete_freitag]

You can't simply upgrade the servlet filter api in JRun because JRun needs to actually implement the new servlet API methods.   Your options are:

1) to deploy to another servlet container (such as Tomcat, JBoss, etc) -- which requires a enterprise license

2) Figure something out at the web server level

3) Don't use J2EE sessions and use CF's sessions, then you can write the session cookies manually in onSessionStart (may not be an option if you need J2EE sessions)

--

Pete Freitag

http://hackmycf.com/ - ColdFusion Server Security Scanner

http://fuseguard.com/ - Web App Firewall for ColdFusion