Enable HttpOnly session cookies by default

.github/workflows/build.yml

@@ -188,14 +188,15 @@ jobs:
 
           echo "Test IDP authentication"
 
-          ADMIN_TOKEN=$(docker exec openam-idp bash -c \
-          'curl -sf \
+          ADMIN_TOKEN=$(docker exec openam-idp bash -o pipefail -c \
+          'curl -sf -D - -o /dev/null \
             --request POST \
             --header "Content-Type: application/json" \
             --header "X-OpenAM-Username: amadmin" \
             --header "X-OpenAM-Password: ampassword" \
             --data "{}" \
-            http://openam.example.org:8080/openam/json/authenticate' |  jq -r .tokenId)
+            http://openam.example.org:8080/openam/json/authenticate \
+            | tr -d "\r" | sed -n "s/^[Ss]et-[Cc]ookie: *iPlanetDirectoryPro=\([^;]*\).*/\1/p" | grep . | tail -n1')
 
           docker inspect --format="{{json .State.Health.Status}}" openam-idp | grep -q \"healthy\"
 
@@ -224,7 +225,7 @@ jobs:
               --header "X-OpenAM-Username: demo" \
               --header "X-OpenAM-Password: changeit" \
               --data "{}" \
-              http://openam.example.org:8080/openam/json/authenticate'
+              http://openam.example.org:8080/openam/json/authenticate | grep -q successUrl'
 
       - name: Docker start with a dedicated OpenDJ container (SP)
         shell: bash
@@ -281,13 +282,13 @@ jobs:
           echo "Test SP authentication"
 
           docker exec openam-sp bash -c \
-            'curl \
+            'curl -sf \
               --request POST \
               --header "Content-Type: application/json" \
               --header "X-OpenAM-Username: amadmin" \
               --header "X-OpenAM-Password: ampassword" \
               --data "{}" \
-              http://sp.mycompany.org:8080/openam/json/authenticate | grep tokenId'
+              http://sp.mycompany.org:8080/openam/json/authenticate | grep -q successUrl'
 
           docker inspect --format="{{json .State.Health.Status}}" openam-sp | grep -q \"healthy\"
 
@@ -302,38 +303,46 @@ jobs:
         with:
           sparse-checkout: e2e
 
-      - name: UI Smoke Tests (Playwright) - HttpOnly disabled
+      - name: UI Smoke Tests (Playwright) - HttpOnly enabled (default)
+        # OpenAM now ships HttpOnly session cookies by default, so a freshly
+        # configured server already reports cookieHttpOnly=true. This stage runs
+        # the (mode-agnostic) XUI specs against that default.
         env:
-          EXPECT_COOKIE_HTTPONLY: "false"
+          EXPECT_COOKIE_HTTPONLY: "true"
         run: |
           cd e2e
           npm init -y
           npm install @playwright/test
           npx playwright install chromium --with-deps
-          npx playwright test --reporter=list
+          echo "verifying the freshly configured server reports cookieHttpOnly=true (the new default)"
+          curl -sf "http://openam.example.org:8080/openam/json/serverinfo/*" | jq -e '.cookieHttpOnly == true'
+          npx playwright test xui --reporter=list
 
-      - name: Enable HttpOnly session cookie on OpenAM IDP and restart
+      - name: Disable HttpOnly session cookie on OpenAM IDP and restart
         shell: bash
         run: |
           # com.sun.identity.cookie.httponly is read once at startup (static field
           # in CookieUtils) and SystemProperties gives JVM -D properties priority,
-          # so we inject it via Tomcat setenv.sh and restart the same container
-          # (its configured data dir is preserved across a restart).
+          # so we inject the non-default value via Tomcat setenv.sh and restart the
+          # same container (its configured data dir is preserved across a restart).
           docker exec openam-idp bash -c '
-            echo "export CATALINA_OPTS=\"\$CATALINA_OPTS -Dcom.sun.identity.cookie.httponly=true\"" > "$CATALINA_HOME/bin/setenv.sh"
+            echo "export CATALINA_OPTS=\"\$CATALINA_OPTS -Dcom.sun.identity.cookie.httponly=false\"" > "$CATALINA_HOME/bin/setenv.sh"
             chmod +x "$CATALINA_HOME/bin/setenv.sh"'
           docker restart openam-idp
           echo "waiting for OpenAM IDP to be alive again..."
           timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" openam-idp | grep -q \"healthy\"; do sleep 10; done'
-          echo "verifying the server now reports cookieHttpOnly=true"
-          curl -sf "http://openam.example.org:8080/openam/json/serverinfo/*" | jq -e '.cookieHttpOnly == true'
+          echo "verifying the server now reports cookieHttpOnly=false"
+          curl -sf "http://openam.example.org:8080/openam/json/serverinfo/*" | jq -e '.cookieHttpOnly == false'
 
-      - name: UI Smoke Tests (Playwright) - HttpOnly enabled
+      - name: UI Smoke Tests (Playwright) - HttpOnly disabled
+        # The full suite (oauth2/saml) runs in the non-HttpOnly mode because those
+        # specs read the SSO tokenId from the /json/authenticate response body,
+        # which is suppressed in the default HttpOnly mode.
         env:
-          EXPECT_COOKIE_HTTPONLY: "true"
+          EXPECT_COOKIE_HTTPONLY: "false"
         run: |
           cd e2e
-          npx playwright test xui --reporter=list
+          npx playwright test --reporter=list
 
       - name: Upload failure artifacts
         uses: actions/upload-artifact@v7
@@ -389,13 +398,13 @@ jobs:
           " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'
 
           docker exec test-openam1 bash -c \
-          'curl \
+          'curl -sf \
            --request POST \
            --header "Content-Type: application/json" \
            --header "X-OpenAM-Username: amadmin" \
            --header "X-OpenAM-Password: ampassword" \
            --data "{}" \
-           http://openam1.example.org:8080/openam/json/authenticate | grep tokenId'
+           http://openam1.example.org:8080/openam/json/authenticate | grep -q successUrl'
 
           docker inspect --format="{{json .State.Health.Status}}" test-openam1 | grep -q \"healthy\"
 
@@ -439,13 +448,13 @@ jobs:
           " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'
 
           docker exec test-openam2 bash -c \
-          'curl \
+          'curl -sf \
           --request POST \
           --header "Content-Type: application/json" \
           --header "X-OpenAM-Username: amadmin" \
           --header "X-OpenAM-Password: ampassword" \
           --data "{}" \
-          http://openam2.example.org:8080/openam/json/authenticate | grep tokenId'
+          http://openam2.example.org:8080/openam/json/authenticate | grep -q successUrl'
 
           docker inspect --format="{{json .State.Health.Status}}" test-openam2 | grep -q \"healthy\"
 
@@ -487,13 +496,13 @@ jobs:
           " > conf.file && java -jar openam-configurator-tool*.jar --file conf.file'
 
           docker exec test-openam3 bash -c \
-          'curl \
+          'curl -sf \
           --request POST \
           --header "Content-Type: application/json" \
           --header "X-OpenAM-Username: amadmin" \
           --header "X-OpenAM-Password: ampassword" \
           --data "{}" \
-          http://openam3.example.org:8080/openam/json/authenticate | grep tokenId'
+          http://openam3.example.org:8080/openam/json/authenticate | grep -q successUrl'
 
           docker inspect --format="{{json .State.Health.Status}}" test-openam3 | grep -q \"healthy\"
 

e2e/common/openam-commons.mjs

@@ -25,6 +25,11 @@ export async function getAdminToken(request) {
     return getAuthToken(request, ADMIN_USER, ADMIN_PASS)
 }
 
+// Resolves the SSO tokenId from the /json/authenticate response body. Note this only works when the
+// session cookie is NOT HttpOnly, or when org.openidentityplatform.openam.httponly.allowTokenInBody
+// is enabled: in the default HttpOnly deployment the token is delivered solely via Set-Cookie and is
+// not echoed in the body, so this helper returns undefined. Specs that rely on it must run against a
+// server with HttpOnly disabled (see the CI matrix in .github/workflows/build.yml).
 export async function getAuthToken(request, username, password) {
   const resp = await request.post(`${OPENAM_BASE}/json/authenticate`, {
     headers: { 

e2e/saml/saml-test.spec.mjs

@@ -115,9 +115,10 @@ test.describe("OpenAM XUI - Login flow", () => {
 
     // ── 7. Assert the SSO session cookie carries a SameSite attribute ───────
     // GHSA-fpmh-vx4h-xc33: the iPlanetDirectoryPro SSO cookie ships with a SameSite attribute by
-    // default so it is not sent on cross-site requests. It is intentionally NOT HttpOnly: the XUI
-    // reads it from document.cookie (SessionToken.jsm / AMConfig.js / AuthNService.js) to track the
-    // session and set REST headers, so enabling HttpOnly by default would break XUI console login.
+    // default so it is not sent on cross-site requests. The check below only asserts the SameSite
+    // attribute; whether the cookie is HttpOnly is governed by com.sun.identity.cookie.httponly (on
+    // by default, and fully supported by the XUI). HttpOnly behaviour is covered by the xui-httponly
+    // spec.
     const cookies = await page.context().cookies();
     const ssoCookie = cookies.find((c) => c.name === "iPlanetDirectoryPro");
     expect(ssoCookie, "iPlanetDirectoryPro SSO cookie should be set").toBeTruthy();

e2e/xui/xui-self-registration.spec.mjs

@@ -0,0 +1,190 @@
+/*
+ * The contents of this file are subject to the terms of the Common Development and
+ * Distribution License (the License). You may not use this file except in compliance with the
+ * License.
+ *
+ * You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+ * specific language governing permission and limitations under the License.
+ *
+ * When distributing Covered Software, include this CDDL Header Notice in each file and include
+ * the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+ * Header, with the fields enclosed by brackets [] replaced by your own identifying
+ * information: "Portions copyright [year] [name of copyright owner]".
+ *
+ * Copyright 2026 3A Systems, LLC.
+ */
+
+/**
+ * OpenAM XUI - self-registration with auto-login
+ *
+ * A user who registers through the XUI with "auto-login" as the registration destination must end up
+ * logged in, and stay logged in across a page reload, in both session cookie modes:
+ *   - HttpOnly off: the registration response carries the tokenId and the XUI writes the cookie;
+ *   - HttpOnly on (the default): JavaScript cannot write the cookie, so the server sets it on the
+ *     registration response and keeps the tokenId out of the body.
+ *
+ * The spec enables self-registration in the top level realm (no captcha, no email verification,
+ * no security questions) and deletes the user it registers.
+ */
+
+import { test, expect } from "@playwright/test";
+import { OPENAM_BASE, ADMIN_USER, ADMIN_PASS } from "../common/openam-commons.mjs";
+
+const SERVICE_URL = `${OPENAM_BASE}/json/realms/root/realm-config/services/selfService`;
+const SERVICE_API = "protocol=1.0,resource=1.0";
+const REGISTRATION = {
+    userRegistrationEnabled: true,
+    userRegisteredDestination: "auto-login",
+    userRegistrationCaptchaEnabled: false,
+    userRegistrationEmailVerificationEnabled: false,
+    userRegistrationKbaEnabled: false,
+};
+
+async function getServerInfo(request) {
+    const resp = await request.get(`${OPENAM_BASE}/json/serverinfo/*`, {
+        headers: { "Accept-API-Version": "protocol=1.0,resource=1.0" },
+    });
+    expect(resp.ok(), "GET /json/serverinfo/* should succeed").toBeTruthy();
+    return resp.json();
+}
+
+/**
+ * Logs in the administrator and returns the SSO token: from the body when the server echoes it,
+ * otherwise from the last non-empty session cookie (HttpOnly mode).
+ */
+async function getAdminSession(request, cookieName) {
+    const resp = await request.post(`${OPENAM_BASE}/json/authenticate`, {
+        headers: {
+            "Content-Type": "application/json",
+            "X-OpenAM-Username": ADMIN_USER,
+            "X-OpenAM-Password": ADMIN_PASS,
+            "Accept-API-Version": "resource=2.0, protocol=1.0",
+        },
+    });
+    expect(resp.ok(), "administrator authentication should succeed").toBeTruthy();
+    const body = await resp.json();
+    if (body.tokenId) {
+        return body.tokenId;
+    }
+    const token = resp.headersArray()
+        .filter((h) => h.name.toLowerCase() === "set-cookie")
+        .map((h) => h.value.split(";", 1)[0])
+        .filter((pair) => pair.startsWith(`${cookieName}=`))
+        .map((pair) => pair.substring(cookieName.length + 1))
+        .filter((value) => value.length > 0)
+        .pop();
+    expect(token, "administrator session must be in the body or the session cookie").toBeTruthy();
+    return token;
+}
+
+/**
+ * Enables self-registration with auto-login, creating the realm's self-service config if needed. The
+ * config comes in sections (generalConfig, userRegistration, ...); the service needs its key aliases,
+ * which a fresh config leaves empty, so the default keystore's self-service keys are filled in.
+ */
+async function enableAutoLoginRegistration(request, adminHeaders) {
+    const current = await request.get(SERVICE_URL, { headers: adminHeaders });
+    const exists = current.status() !== 404;
+    const source = exists ? current : await request.post(`${SERVICE_URL}?_action=template`, { headers: adminHeaders });
+    expect(source.ok(), `reading the self-service config: ${await source.text()}`).toBeTruthy();
+    const config = await source.json();
+    delete config._id;
+    delete config._rev;
+    delete config._type;
+    config.generalConfig = {
+        ...config.generalConfig,
+        encryptionKeyPairAlias: config.generalConfig?.encryptionKeyPairAlias || "selfserviceenctest",
+        signingSecretKeyAlias: config.generalConfig?.signingSecretKeyAlias || "selfservicesigntest",
+    };
+    config.userRegistration = { ...config.userRegistration, ...REGISTRATION };
+    const saved = exists
+        ? await request.put(SERVICE_URL, {
+            headers: { ...adminHeaders, "Content-Type": "application/json" }, data: config })
+        : await request.post(`${SERVICE_URL}?_action=create`, {
+            headers: { ...adminHeaders, "Content-Type": "application/json" }, data: config });
+    expect(saved.ok(), `saving the self-service config: ${await saved.text()}`).toBeTruthy();
+}
+
+/** Resolves the username of the session the browser's (auto-sent) cookie carries. */
+async function idFromSession(request) {
+    const resp = await request.post(`${OPENAM_BASE}/json/users?_action=idFromSession`, {
+        headers: { "Accept-API-Version": "protocol=1.0,resource=2.0" },
+    });
+    return resp.ok() ? (await resp.json()).id : null;
+}
+
+test.describe("OpenAM XUI - self-registration", () => {
+    test("a user registered with auto-login is logged in and stays logged in after a reload",
+        async ({ page, context, request }) => {
+            const info = await getServerInfo(request);
+            const cookieName = info.cookieName ?? "iPlanetDirectoryPro";
+            const httpOnly = info.cookieHttpOnly === true;
+            console.log(`Server reports cookieName=${cookieName}, cookieHttpOnly=${httpOnly}`);
+
+            const adminHeaders = {
+                [cookieName]: await getAdminSession(request, cookieName),
+                "Accept-API-Version": SERVICE_API,
+            };
+            await enableAutoLoginRegistration(request, adminHeaders);
+
+            const username = `selfreg${Date.now()}`;
+            const password = "Selfreg-Passw0rd";
+            try {
+                // ── 1. Register through the XUI ─────────────────────────────────────
+                await page.goto(`${OPENAM_BASE}/XUI/#register/`);
+                await expect(page.locator("#input-username")).toBeVisible({ timeout: 30_000 });
+                await page.fill("#input-username", username);
+                await page.fill("#input-givenName", "Self");
+                await page.fill("#input-sn", "Registered");
+                // The password validators run asynchronously on keyup, which fill() does not fire, and a
+                // stale result for a shorter prefix can land last; a final keyup revalidates the whole value
+                for (const field of ["#input-password", "#input-confirmPassword"]) {
+                    await page.locator(field).pressSequentially(password, { delay: 20 });
+                    await page.waitForTimeout(500);
+                    await page.locator(field).press("End");
+                }
+                const submit = page.locator("input[type=\"submit\"]");
+                await expect(submit, "the form must validate before it can be submitted").toBeEnabled();
+
+                const registered = page.waitForResponse((resp) =>
+                    resp.url().includes("selfservice/userRegistration")
+                    && resp.url().includes("_action=submitRequirements")
+                    && resp.status() === 200, { timeout: 30_000 });
+                await submit.click();
+                const registration = await (await registered).json();
+
+                // ── 2. The session travels as the server intends in this mode ───────
+                expect(registration.type, "registration must end in the auto-login stage").toBe("autoLoginStage");
+                expect(registration.tag).toBe("end");
+                if (httpOnly) {
+                    expect(registration.additions?.tokenId,
+                        "the registration response must not expose the session in HttpOnly mode").toBeFalsy();
+                } else {
+                    expect(registration.additions?.tokenId, "the XUI needs the tokenId to write the cookie")
+                        .toBeTruthy();
+                }
+
+                // ── 3. The browser holds the session cookie with the server's HttpOnly flag ──
+                await page.waitForURL((url) => !url.hash.startsWith("#register"), { timeout: 30_000 });
+                await expect.poll(async () => (await context.cookies()).find((c) => c.name === cookieName),
+                    { message: `session cookie "${cookieName}" must be set`, timeout: 15_000 }).toBeTruthy();
+                const session = (await context.cookies()).find((c) => c.name === cookieName);
+                expect(session.httpOnly, "cookie HttpOnly attribute must match the server mode").toBe(httpOnly);
+
+                // ── 4. The new user is logged in, before and after a reload ─────────
+                expect(String(await idFromSession(page.request)).toLowerCase()).toBe(username.toLowerCase());
+                await page.reload({ waitUntil: "networkidle" });
+                expect(page.url(), "reload must not redirect to the login page").not.toContain("#login");
+                expect(String(await idFromSession(page.request)).toLowerCase()).toBe(username.toLowerCase());
+            } finally {
+                try {
+                    const deleted = await request.delete(`${OPENAM_BASE}/json/realms/root/users/${username}`, {
+                        headers: { ...adminHeaders, "Accept-API-Version": "protocol=1.0,resource=2.0" },
+                    });
+                    console.log(`Deleting ${username}: HTTP ${deleted.status()}`);
+                } catch (e) {
+                    console.log(`Could not delete ${username}: ${e.message}`);
+                }
+            }
+        });
+});

openam-core-rest/src/test/java/org/forgerock/openam/core/rest/authn/RestAuthenticationHandlerTest.java

@@ -74,7 +74,12 @@ public class RestAuthenticationHandlerTest {
     private CoreServicesWrapper coreServicesWrapper;
 
     @BeforeMethod
-    public void setUp() {
+    public void setUp() throws Exception {
+
+        // Establish the token-readable baseline (HttpOnly off) for every test, independent of the
+        // production default of com.sun.identity.cookie.httponly. Tests that exercise HttpOnly mode
+        // opt in explicitly via setCookieHttpOnly(true) and reset it afterwards.
+        setCookieHttpOnly(false);
 
         loginAuthenticator = mock(LoginAuthenticator.class);
         restAuthCallbackHandlerManager = mock(RestAuthCallbackHandlerManager.class);