Shibboleth Developers

[Bradley Schwoerer <>]

One of our application admins brought it to my attention that even with 
handlerSSL="true" in the Sessions block for the Shib SP config that it 
does not by default mark the cookies secure.  After researching I found 
that adding cookieProps="; path=/; secure" in the Sessions block makes 
it mark the cookies as secure.

Is there a config option that we are not setting properly, or is that by 
design?  Is it possible to change it so that by default with 
handlerSSL="true" that it sets the secure flag for the cookie?

Thanks

-Bradley