Pārlūkot izejas kodu

HUE-1639 [core] HTTPOnly on session cookie

Abraham Elmahrek 12 gadi atpakaļ
vecāks
revīzija
21edfc1

+ 3 - 0
desktop/conf.dist/hue.ini

@@ -207,6 +207,9 @@
     # Should only be enabled with HTTPS.
     ## secure=false
 
+    # The cookie containing the users' session ID will use the HTTP only flag.
+    ## http_only=false
+
 
   # Configuration options for connecting to an external SMTP server
   # ------------------------------------------------------------------------

+ 3 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -213,6 +213,9 @@
     # Should only be enabled with HTTPS.
     ## secure=false
 
+    # The cookie containing the users' session ID will use the HTTP only flag.
+    ## http_only=false
+
   # Configuration options for connecting to an external SMTP server
   # ------------------------------------------------------------------------
   [[smtp]]

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -253,6 +253,12 @@ SESSION = ConfigSection(
       help=_("The cookie containing the users' session ID will be secure. This should only be enabled with HTTPS."),
       type=coerce_bool,
       default=False,
+    ),
+    HTTP_ONLY=Config(
+      key='http_only',
+      help=_("The cookie containing the users' session ID will use the HTTP only flag."),
+      type=coerce_bool,
+      default=False
     )
   )
 )

+ 3 - 0
desktop/core/src/desktop/settings.py

@@ -277,6 +277,9 @@ DATABASES = {
 SESSION_COOKIE_AGE = desktop.conf.SESSION.TTL.get()
 SESSION_COOKIE_SECURE = desktop.conf.SESSION.SECURE.get()
 
+# HTTP only
+SESSION_COOKIE_HTTPONLY = desktop.conf.SESSION.HTTP_ONLY.get()
+
 # django-nose test specifics
 TEST_RUNNER = 'desktop.lib.test_runners.HueTestRunner'
 # Turn off cache middleware