Add httpOnly to cookieProps in the shibboleth2.xml config

http://svn.shibboleth.net/view/cpp-sp?view=revision&revision=3517

Getting this in early so I can test through the life cycle with HttpOnly set.

I fully understand. I'll try to get this tested in our environment and report back.
For 2.4.3 you could just add the httpOnly to the comment within the config file.
With 2.5 you can then promote it to the default config.

I think my suggestion would be to find somebody with an AJAX scenario who can verify using it works ok, and then add it to the default properties used in 2.5. That way it gets set out of the box instead of just for people who overide the setting.

Even if it's a good thing to use, I don't like making changes of that degree in a patch release.

If JavaScript launches an HTTP request, the browser should automatically add the cookie to that request, without JavaScript itself having access to it.
So I think it should not negatively influence JavaScript requests.

I may also not understand it correctly. I know it blocks client side access to the cookie, but I'm not clear whether it blocks use of the cookie when making Javascript calls to the server.