Jive uses HTTP cookies in
several places in the application to provide a better user experience.
Jive does not set
third-party cookies as part of the core product offering; however, it is possible for
you to configure the application so that third-party cookies are set. For example, you
can configure the application to use a Web-tracking tool such as Google Analytics or
Webtrends, each of whom may set a third-party cookie.
Jive does not set the
"domain" attribute of an HTTP cookie.
Starting with Jive version 4.5.7, all Jive cookies that are set by the server (not via the client or
browser) have the HttpOnly flag.
Setting Up Secure Cookies
Out of the box,
Jive is
not configured to set the "secure" attribute for cookies that should only be sent via
HTTPS connections. You can configure
Jive to send only
allowed, secure cookies through the following process:
- Set the Jive system
property "jive.cookies.secure" to the value "true". This results in all Jive-specific cookies (not including JSESSIONID) having the "secure" attribute
set on the cookie ().
- Configure both Apache and Tomcat to only allow HTTPS connections. To understand
these configurations, see Forcing
Traffic to HTTPS and Enabling SSL
Encryption.
- Finally, configure Tomcat with the "secure" attribute set to "true" in the
server.xml configuration file, specifically the
"server/connector" element.
How Jive Sets Cookies
Jive performs an audit by
searching for all instances of "setCookie" in the source code, and then sets the
following cookies.
Note: Except where noted, all of the following cookies do not
contain user-identifiable information. This behavior meets European Union
privacy laws.
- SPRING_SECURITY_REMEMBER_ME_COOKIE
- This cookie is used on the front-end as part of the security authentication
process to denote whether or not the user wants to have their
credentials persist across sessions. It is part of the Spring Security
specification; details are available here.
- Possible values: string, the Base64 encoded username and
expiration time combined with an MD5 hex hash of the username,
password, expiration time, and private key.
- Expiration: defaults to 14 days.
- Encryption: none. This is an MD5 hex hash.
- Example:
SPRING_SECURITY_REMEMBER_ME_COOKIE="YWFyb246MTMxNTU4MjUzNTI3MDoyZDUyODNmZjhhNjExZTdlMTcyMGZhYjVhNWNkNjI0Yg"
- JSESSIONID
- This cookie is used on the front-end and the Admin Console to identify a session.
It is part of the Java Servlet specification.
- Possible values: string, the unique token generated by Apache
Tomcat.
- Expiration: at session end.
- Encryption: none.
- Example:
JSESSIONID="1315409220832msB9E3A98AA1F2005E61FA975963FA4D12.node01"
- jive.security.context
- This cookie is the authentication context for the user.
- Possible values: the user's encrypted security context.
- Expiration: 30 minutes unless refreshed. Same as the standard
servlet container session timeout.
- Encryption: AES 256.
- Example: jive.security.context="SdRw2i/HXoh1+LwTBLFy3Q==.MzA3OQ=="
- jive.server.info
- This cookie is used on the front-end in combination with Content Distribution
Networks (CDN) like Akamai to associate the user with a specific server
(also known as "session affinity").
- Possible values: string, a combination of the serverName,
serverPort, contextPath, localName, localPort, and
localAddr.
- Expiration: at session end.
- Encryption: none.
- Example:
jive.server.info="serverName=community.example.com:serverPort=443:contextPath=
:localName=localhost.localdomain:localPort=9001:localAddr=127.0.0.1"
- jive.user.loggedin
- This cookie is used on the front-end in combination with Content Distribution
Networks (CDN) to denote the status of the current request.
- Possible values: string, true if the current request originates
from a browser where the user is logged in.
- Expiration: at session end.
- Encryption: none.
- Example: jive.user.loggedin="true"
- jive_wysiwygtext_height
- This cookie is used on the front-end to persist the height of the editor window
across sessions.
- Possible values: integer, the height in pixels of the editor
after the user chooses to expand the editor window.
- Expiration: one year.
- Example: jive_wysiwygtext_height="500"
- jive_default_editor_mode
- This cookie is used on the front-end for guest/anonymous users who choose to use an
editor mode other than the default editor mode.
- Possible values: string, advanced.
- Expiration: 30 days.
- Encryption: none.
- Example: jive_default_editor_mode="advanced"
- clickedFolder
- This cookie is used in the Admin Console to persist the open/closed status of the
current folder as used in various tree-view portions of the Admin
Console.
- Possible values: string, true, or false.
- Expiration: at session end.
- Encryption: none.
- Example: clickedFolder="true"
- highlightedTreeviewLink
- This cookie is used in the Admin Console to persist the current folder as used in
various tree-view portions of the Admin Console.
- Possible values: integer, the DOM ID of the clicked folder.
- Expiration: at session end.
- Encryption: none.
- Example: highlightedTreeviewLink="23"
- jiveLocale
- This cookie is used on the front-end for guest/anonymous users who choose a locale
setting.
- Possible values: string, locale code.
- Expiration: 30 days.
- Encryption: none.
- Example: jiveLocale="en_US"
- jiveTimeZoneID
- This cookie is used on the front-end for guest/anonymous users who choose a timezone
setting.
- Possible values: string, timezone ID.
- Expiration: 30 days.
- Example: jiveTimeZoneID="234"
- jive-cookie
- This cookie is used in the Admin Console to temporarily persist an encrypted
username/password when creating a bridge between two sites. The
information in the cookie is first encrypted with AES/256 encryption and
then Base64 encoded.
- Possible values: string, Base64 encoded, encrypted
username/password of remote site.
- Expiration: at session end.
- Encryption: yes.
- Example:
jive-cookie="YWFyb246MTMxNTU4MjUzNTI3MDoyZDUyODNmZjhhNjExZTdlMTcyMGZhYjVhNWNkNjI0Yg"
- jive.user.lastvisited
- This cookie is used on the front-end to store the last time the user visited the
site.
- Possible values: long, value in milliseconds that represents the
time of the login.
- Expiration: 30 days.
- Encryption: none.
- Example: jive.user.lastvisited="1315292400000"
- linkedin_oauth_
- This cookie is used to communicate and authenticate with LinkedIn.