Ver Fonte

[cookies] cookies to expire at browser closing

Our `sessionid` cookie has a 14 days of expiry. This means that if a
user forgets to click logout button and instead just closes the browser
window, they remain signed in. This is a security hole, especially if
the computer is used by multiple people. Someone else can gain access
to the previous user's data.

This commits sets the default age of `sessionid` and `csrftoken` to `0`.
This will make these cookies non-persistent and held only in memory.
These cookies will get cleared on browser restart.

In addition, this commit also enforces the same for google analytics
cookies.
Amit Srivastava há 10 meses atrás
pai
commit
77bad76e3d

+ 3 - 3
apps/beeswax/src/beeswax/data_export.py

@@ -16,8 +16,8 @@
 # limitations under the License.
 
 import json
-import math
 import logging
+import math
 
 from django.utils.translation import gettext as _
 
@@ -28,7 +28,7 @@ LOG = logging.getLogger()
 
 
 FETCH_SIZE = 1000
-DOWNLOAD_COOKIE_AGE = 1800  # 30 minutes
+DOWNLOAD_COOKIE_AGE = None  # Session cookie - expires when browser closes
 
 
 def download(handle, format, db, id=None, file_name='query_result', user_agent=None):
@@ -124,7 +124,7 @@ class DataAdapter(object):
         size += len(str(col))
       elif col_type is bool:
         size += 4
-      elif col_type == type(None):
+      elif col_type is type(None):
         size += 4
       else:
         size += len(str(col))

+ 2 - 2
desktop/core/src/desktop/conf.py

@@ -1007,13 +1007,13 @@ SESSION = ConfigSection(
       key='expire_at_browser_close',
       help=_("Use session-length cookies. Logs out the user when she closes the browser window."),
       type=coerce_bool,
-      default=False
+      default=True
     ),
     CSRF_COOKIE_AGE=Config(
       key='csrf_cookie_age',
       help=_("CRSF cookie age defaults to 1 year. If the value is set to 0, it means per session. Time in seconds"),
       type=int,
-      default=60 * 60 * 24 * 7 * 52,
+      default=0,
     ),
     CONCURRENT_USER_SESSION_LIMIT=Config(
       key="concurrent_user_session_limit",

+ 2 - 1
desktop/core/src/desktop/templates/hue.mako

@@ -55,7 +55,8 @@
         send_page_view: false, 
         page_location: 'redacted',
         page_referrer: 'redacted',
-        allow_google_signals: false
+        allow_google_signals: false,
+        cookie_expires: 0
         });
     </script>
   % endif

+ 8 - 1
docs/docs-site/layouts/partials/custom-footer.html

@@ -5,5 +5,12 @@
   function gtag(){dataLayer.push(arguments);}
   gtag('js', new Date());
 
-  gtag('config', 'UA-37637545-1');
+  gtag('config', '${ conf.GTAG_ID.get()}', {
+    // Prevent GA from accidentally passing client meta data present in urls
+    send_page_view: false, 
+    page_location: 'redacted',
+    page_referrer: 'redacted',
+    allow_google_signals: false,
+    cookie_expires: 0
+  });
 </script>

+ 8 - 1
docs/gethue/themes/stack-hue-theme/layouts/partials/footer.html

@@ -74,7 +74,14 @@
   function gtag(){dataLayer.push(arguments);}
   gtag('js', new Date());
 
-  gtag('config', 'UA-37637545-1');
+  gtag('config', '${ conf.GTAG_ID.get()}', {
+    // Prevent GA from accidentally passing client meta data present in urls
+    send_page_view: false, 
+    page_location: 'redacted',
+    page_referrer: 'redacted',
+    allow_google_signals: false,
+    cookie_expires: 0
+  });
 </script>
 
 </body>