fix(springboot): add session-cookie-path-enforcement flag to isolate … by Fejbien · Pull Request #2609 · operaton/operaton

Fejbien · 2026-03-19T13:32:10Z

…Operaton session cookie (LF insted of crlf)

introduces operaton.bpm.webapp.session-cookie-path-enforcement property (default false)
when enabled, applies Path=/operaton to session cookie via filter to prevent JSESSIONID conflicts
resolves conflict with backend/Keycloak session when running in single Spring Boot app

related to #1632

…Operaton session cookie (LF insted of crlf) - introduces operaton.bpm.webapp.session-cookie-path-enforcement property (default false) - when enabled, applies Path=/operaton to session cookie via filter to prevent JSESSIONID conflicts - resolves conflict with backend/Keycloak session when running in single Spring Boot app related to operaton#1632

Copilot

Pull request overview

This PR extends the Spring Boot webapp integration to better isolate Operaton’s session cookie in “single Spring Boot app” setups (e.g., backend + Keycloak + Operaton) by enabling optional session-cookie path enforcement and by enhancing existing cookie-related filters/config.

Changes:

Add optional operaton.bpm.webapp.session-cookie-path-enforcement that registers a new response-wrapping filter to enforce a Path attribute on the session cookie.
Extend cookie configuration to support cookiePath and improve session-cookie header detection/configuration in SessionCookieFilter.
Introduce operaton.bpm.session.cookie.name (via new SessionProperties) and wire it into filter init params as an alias for session cookie name handling.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
webapps/assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/SessionCookieFilter.java	Enhances Set-Cookie rewriting to also enforce a configured cookie `Path`.
webapps/assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/CsrfPreventionFilter.java	Decouples CSRF cookie naming from session-cookie configuration by introducing a dedicated `csrfCookieName`.
webapps/assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/CookieConfigurator.java	Adds support for parsing and exposing a `cookiePath` init param, and allows explicit `cookieName` init param override.
spring-boot-starter/starter/src/main/java/org/operaton/bpm/spring/boot/starter/property/SessionProperties.java	Adds new nested config object for `operaton.bpm.session.cookie.name`.
spring-boot-starter/starter/src/main/java/org/operaton/bpm/spring/boot/starter/property/SessionCookieProperties.java	Adds `cookiePath` property and passes it through to filter init params.
spring-boot-starter/starter/src/main/java/org/operaton/bpm/spring/boot/starter/property/OperatonBpmProperties.java	Wires new `SessionProperties` into the root configuration properties.
spring-boot-starter/starter-webapp-core/src/main/java/org/operaton/bpm/spring/boot/starter/webapp/filter/SessionCookiePathFilter.java	New filter that rewrites the session cookie Path via `addCookie` and `Set-Cookie` header rewriting.
spring-boot-starter/starter-webapp-core/src/main/java/org/operaton/bpm/spring/boot/starter/webapp/OperatonBpmWebappInitializer.java	Adds alias wiring: `operaton.bpm.session.cookie.name` → SessionCookieFilter init params.
spring-boot-starter/starter-webapp-core/src/main/java/org/operaton/bpm/spring/boot/starter/webapp/OperatonBpmWebappAutoConfiguration.java	Registers the new `SessionCookiePathFilter` behind the `session-cookie-path-enforcement` flag.
spring-boot-starter/starter-webapp-core/src/test/java/org/operaton/bpm/spring/boot/starter/webapp/filter/util/HttpClientExtension.java	Updates the default expected session-cookie Path segment in test regex helpers.

Comments suppressed due to low confidence (1)

webapps/assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/SessionCookieFilter.java:53

doFilter only invokes filterChain.doFilter(...) when both request/response are HTTP. If this filter is ever applied to non-HTTP requests/responses, the chain will not proceed and the request will effectively be dropped. Consider adding an else branch that delegates to filterChain.doFilter(servletRequest, servletResponse) to preserve the Filter contract.

  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
          throws IOException, ServletException {
    if ((servletRequest instanceof HttpServletRequest httpServletRequest) && (servletResponse instanceof HttpServletResponse httpServletResponse)) {
      // create a session if none exists yet
      httpServletRequest.getSession();
      // execute filter chain with a response wrapper that handles sameSite attributes
      filterChain.doFilter(httpServletRequest, new SameSiteResponseProxy(httpServletResponse));
    }
  }

related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 7 comments.

Comments suppressed due to low confidence (1)

webapps/assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/SessionCookieFilter.java:53

SessionCookieFilter.doFilter only invokes filterChain.doFilter() inside the HttpServletRequest/HttpServletResponse instanceof check; if the filter is ever applied to a non-HTTP request/response, the chain will not continue and the request will effectively be dropped. Consider always calling filterChain.doFilter(...), wrapping only when the request/response are HTTP.

  public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
          throws IOException, ServletException {
    if ((servletRequest instanceof HttpServletRequest httpServletRequest) && (servletResponse instanceof HttpServletResponse httpServletResponse)) {
      // create a session if none exists yet
      httpServletRequest.getSession();
      // execute filter chain with a response wrapper that handles sameSite attributes
      filterChain.doFilter(httpServletRequest, new SameSiteResponseProxy(httpServletResponse));
    }
  }

Copilot · 2026-03-20T14:58:21Z

  public String getSessionCookieRegex(String sameSite) {
-    return getSessionCookieRegex(null, null, sameSite, false);
+    return getSessionCookieRegex(DEFAULT_SESSION_COOKIE_PATH, null, sameSite, false);
  }

  public String getSessionCookieRegex(String cookieName, String sameSite) {


HttpClientExtension now assumes the default expected session cookie Path is '/operaton' (via DEFAULT_SESSION_COOKIE_PATH). Existing session-cookie tests that don't enable path enforcement historically expected Path='/' and will likely fail. Consider keeping the default regex path as '/' (or leaving it unset) and only passing an explicit path in the new path-enforcement tests.

Copilot · 2026-03-20T14:58:22Z

+    httpClientExtension.performRequest("http://localhost:" + port + "/operaton/app/tasklist/default");
+
+    assertThat(httpClientExtension.getCookie("JSESSIONID"))
+        .as("JSESSIONID should not exist when operaton.bpm.session.cookie.name is set alias wiring may be broken")


The assertion message references operaton.bpm.session.cookie.name, but this test configures the cookie name via server.servlet.session.cookie.name. Updating the message to match the actual configuration will make failures easier to understand.

Suggested change

.as("JSESSIONID should not exist when operaton.bpm.session.cookie.name is set alias wiring may be broken")

.as("JSESSIONID should not exist when server.servlet.session.cookie.name is set; alias wiring may be broken")

Copilot · 2026-03-20T14:58:22Z

+    if (StringUtils.isNotBlank(cookiePath)) {
+      initParams.put("cookiePath", cookiePath);
+    }


cookiePath is user-configurable and later inserted into Set-Cookie headers. To prevent invalid cookies / header injection, validate/normalize it (e.g., ensure it starts with '/', and reject CR/LF and ';') before putting it into initParams.

…path against invalid chars - path is set automatically (in bean) based of operaton.bpm.webapp.application-path and server.servlet.context-path related to operaton#1632

related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

…t state - Renames SessionCookiePathEnforcementDefaultIT to SessionCookiePathEnforcementEnabledDefaultIT - Renames SessionCookiePathEnforcementCustomIT to SessionCookiePathEnforcementEnabledCustomIT - SessionCookiePathEnforcementDisabledIT to test the actual default behavior (disabled) without explicitly setting the property related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Copilot · 2026-03-27T07:28:04Z


  @NestedConfigurationProperty
  private FilterProperty filter = new FilterProperty();



A new operaton.bpm.session.* configuration subtree is introduced (SessionProperties), but there is already an existing operaton.bpm.webapp.session-cookie.cookie-name (via SessionCookieProperties) that maps to the same cookieName init parameter. Adding a second way to configure the same behavior is confusing for users and complicates the public configuration surface; consider reusing the existing webapp.session-cookie.cookie-name property (or clearly documenting and differentiating responsibilities if both are required).

Suggested change

/**

* Deprecated configuration subtree for HTTP session settings.

* <p>

* This property exposes the {@code operaton.bpm.session.*} configuration

* subtree, which configures the same underlying behavior (including the

* {@code cookieName} init parameter) as

* {@code operaton.bpm.webapp.session-cookie.cookie-name}.

* <p>

* New configurations should use

* {@code operaton.bpm.webapp.session-cookie.cookie-name} instead of this

* property. The {@code operaton.bpm.session.*} subtree is kept only for

* backward compatibility and may be removed in a future release.

*/

@Deprecated

…to csrf cookie related to operaton#1632

…istration test related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 4 comments.

Copilot · 2026-04-01T11:46:38Z

+
+  /**
+   * Initializes the filter by reading the configuration parameters.
+   * * <p>If the {@value #PARAM_SESSION_COOKIE_NAME} or {@value #PARAM_COOKIE_PATH}


There is a stray extra * in the Javadoc ("* *
...") which will render oddly in generated docs. Please remove the redundant asterisk so the Javadoc formatting stays correct.

Suggested change

* * <p>If the {@value #PARAM_SESSION_COOKIE_NAME} or {@value #PARAM_COOKIE_PATH}

* <p>If the {@value #PARAM_SESSION_COOKIE_NAME} or {@value #PARAM_COOKIE_PATH}

- Retrieve session cookie name from ServletContext as a reliable fallback - Delegate cookie path formatting to SessionCookiePathFilter.normalizeCookiePath - Remove unused StringUtils - Remove asterisk in SessionCookiePathFilter Javadoc related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

…mming related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 2 comments.

related to operaton#1632

Copilot

Pull request overview

Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.

… finding one

kthoms · 2026-04-07T06:08:13Z

@Fejbien Sorry for the long delay. I had finally the rest to look at your PR in detail. I have added some changes and think it is now in a good shape. I will have a final look, but planning to merge for release 2.1.

kthoms · 2026-04-08T12:11:48Z

Thank you for your patience and contributions, @Fejbien !

kthoms reviewed Mar 19, 2026

View reviewed changes

Comment thread ...rc/main/java/org/operaton/bpm/spring/boot/starter/webapp/filter/SessionCookiePathFilter.java

Comment thread ...r/starter/src/main/java/org/operaton/bpm/spring/boot/starter/property/SessionProperties.java Outdated

kthoms requested a review from Copilot March 19, 2026 23:08

Copilot started reviewing on behalf of kthoms March 19, 2026 23:08 View session

Copilot AI reviewed Mar 19, 2026

View reviewed changes

Comment thread ...ain/java/org/operaton/bpm/spring/boot/starter/webapp/OperatonBpmWebappAutoConfiguration.java

Comment thread ...ain/java/org/operaton/bpm/spring/boot/starter/webapp/OperatonBpmWebappAutoConfiguration.java

fabian.sucholas added 3 commits March 20, 2026 09:11

fix(springboot): add missing licenses headers

b0c5d70

related to operaton#1632

fix(springboot): add support for server.servlet.context-path

47020f0

related to operaton#1632

fix(springboot): add tests

4f6f18a

related to operaton#1632

Fejbien requested a review from Copilot March 20, 2026 14:48

Copilot started reviewing on behalf of Fejbien March 20, 2026 14:49 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

fabian.sucholas added 2 commits March 23, 2026 12:16

fix(springboot): revert custom path setting, fix test message, guard …

61d2613

…path against invalid chars - path is set automatically (in bean) based of operaton.bpm.webapp.application-path and server.servlet.context-path related to operaton#1632

fix(springboot): remove unused cookiePath variable

3e07fb0

related to operaton#1632

kthoms requested a review from Copilot March 25, 2026 06:38

Copilot started reviewing on behalf of kthoms March 25, 2026 06:39 View session

Copilot AI reviewed Mar 25, 2026

View reviewed changes

Comment thread .../boot/starter/webapp/filter/session/it/properties/SessionCookiePathEnforcementDefaultIT.java Outdated

Comment thread ...tarter/webapp/filter/session/it/properties/SessionCookiePathEnforcementEnabledDefaultIT.java Outdated

Fejbien requested a review from kthoms March 26, 2026 14:50

kthoms requested a review from Copilot March 27, 2026 07:20

Copilot started reviewing on behalf of kthoms March 27, 2026 07:21 View session

Copilot AI reviewed Mar 27, 2026

View reviewed changes

kthoms reviewed Mar 27, 2026

View reviewed changes

Comment thread ...rc/main/java/org/operaton/bpm/spring/boot/starter/webapp/filter/SessionCookiePathFilter.java

Copilot AI mentioned this pull request Mar 27, 2026

feat(spring-boot): add session-cookie-path-enforcement to isolate Operaton session cookie #2677

Closed

fabian.sucholas added 2 commits March 27, 2026 13:01

fix(springboot): remove duplicated SessionProperties, add validation …

101da9c

…to csrf cookie related to operaton#1632

fix(springboot): add Javadoc, extract path normalization, and add reg…

b60fe19

…istration test related to operaton#1632

Fejbien requested a review from Copilot April 1, 2026 11:41

Copilot started reviewing on behalf of Fejbien April 1, 2026 11:42 View session

Copilot AI reviewed Apr 1, 2026

View reviewed changes

Fejbien requested a review from Copilot April 2, 2026 07:01

Copilot started reviewing on behalf of Fejbien April 2, 2026 07:02 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Comment thread ...ain/java/org/operaton/bpm/spring/boot/starter/webapp/OperatonBpmWebappAutoConfiguration.java

Comment thread .../assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/CookieConfigurator.java

fix(springboot): guard against blank session cookie names and add tri…

893a1b5

…mming related to operaton#1632

Fejbien requested a review from Copilot April 2, 2026 09:12

Copilot started reviewing on behalf of Fejbien April 2, 2026 09:13 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

Comment thread ...rc/main/java/org/operaton/bpm/spring/boot/starter/webapp/filter/SessionCookiePathFilter.java Outdated

Comment thread .../assembly/src/main/java/org/operaton/bpm/webapp/impl/security/filter/CookieConfigurator.java

fix(springboot): validate cookieName and redact Set-Cookie trace logs

c99b0de

related to operaton#1632

Fejbien requested a review from Copilot April 3, 2026 12:50

Copilot started reviewing on behalf of Fejbien April 3, 2026 12:50 View session

Copilot AI reviewed Apr 3, 2026

View reviewed changes

kthoms added 3 commits April 7, 2026 07:30

Add securityFilterRules.json to satisfy ResourceLoadingSecurityFilter…

6647dfe

… finding one

Combine tests into 1 single test class with Nested tests

b767ad5

Move COOKIE_NAME_FORBIDDEN to CookieConstants

fea4004

kthoms added scope:spring-boot Changes to the Spring Boot starter. noteworthy Should be documented in the release notes labels Apr 7, 2026

kthoms added this to the 2.1.0 milestone Apr 7, 2026

Add since tags

71238eb

kthoms merged commit b3e0c40 into operaton:main Apr 8, 2026
12 checks passed

	.as("JSESSIONID should not exist when operaton.bpm.session.cookie.name is set alias wiring may be broken")
	.as("JSESSIONID should not exist when server.servlet.session.cookie.name is set; alias wiring may be broken")


		@NestedConfigurationProperty
		private FilterProperty filter = new FilterProperty();

+  /**
+   * Deprecated configuration subtree for HTTP session settings.
+   * <p>
+   * This property exposes the {@code operaton.bpm.session.*} configuration
+   * subtree, which configures the same underlying behavior (including the
+   * {@code cookieName} init parameter) as
+   * {@code operaton.bpm.webapp.session-cookie.cookie-name}.
+   * <p>
+   * New configurations should use
+   * {@code operaton.bpm.webapp.session-cookie.cookie-name} instead of this
+   * property. The {@code operaton.bpm.session.*} subtree is kept only for
+   * backward compatibility and may be removed in a future release.
+   */
+  @Deprecated

	* * <p>If the {@value #PARAM_SESSION_COOKIE_NAME} or {@value #PARAM_COOKIE_PATH}
	* <p>If the {@value #PARAM_SESSION_COOKIE_NAME} or {@value #PARAM_COOKIE_PATH}

Conversation

Fejbien commented Mar 19, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Apr 1, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kthoms commented Apr 7, 2026

Uh oh!

Uh oh!

kthoms commented Apr 8, 2026

Uh oh!