Browse Source

HUE-1529 [core] cookies should be secure

Abraham Elmahrek 12 years ago
parent
commit
5bba2e2

+ 4 - 0
desktop/conf.dist/hue.ini

@@ -181,6 +181,10 @@
     # The cookie containing the users' session ID will expire after this amount of time in seconds.
     ## ttl=60*60*24*14
 
+    # The cookie containing the users' session ID will be secure.
+    # Should only be enabled with HTTPS.
+    ## secure=false
+
 
   # Configuration options for connecting to an external SMTP server
   # ------------------------------------------------------------------------

+ 4 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -187,6 +187,10 @@
     # The cookie containing the users' session ID will expire after this amount of time in seconds.
     ## ttl=60*60*24*14
 
+    # The cookie containing the users' session ID will be secure.
+    # Should only be enabled with HTTPS.
+    ## secure=false
+
   # Configuration options for connecting to an external SMTP server
   # ------------------------------------------------------------------------
   [[smtp]]

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -221,6 +221,12 @@ SESSION = ConfigSection(
       help=_("The cookie containing the users' session ID will expire after this amount of time in seconds."),
       type=int,
       default=60*60*24*14,
+    ),
+    SECURE=Config(
+      key='secure',
+      help=_("The cookie containing the users' session ID will be secure. This should only be enabled with HTTPS."),
+      type=coerce_bool,
+      default=False,
     )
   )
 )

+ 1 - 0
desktop/core/src/desktop/settings.py

@@ -251,6 +251,7 @@ DATABASES = {
 
 # Configure sessions
 SESSION_COOKIE_AGE = desktop.conf.SESSION.TTL.get()
+SESSION_COOKIE_SECURE = desktop.conf.SESSION.SECURE.get()
 
 # django-nose test specifics
 TEST_RUNNER = 'desktop.lib.test_runners.HueTestRunner'