Ver Fonte

[cookies] cookies to expire at browser closing

Our `sessionid` cookie has a 14 days of expiry. This means that if a
user forgets to click logout button and instead just closes the browser
window, they remain signed in. This is a security hole, especially if
the computer is used by multiple people. Someone else can gain access
to the previous user's data.

This commits sets the default age of `sessionid` and `csrftoken` to `0`.
This will make these cookies non-persistent and held only in memory.
These cookies will get cleared on browser restart.

In addition, this commit also enforces the same for google analytics
cookies.
Amit Srivastava há 10 meses atrás
pai
commit
77bad76e3d

+ 3 - 3
apps/beeswax/src/beeswax/data_export.py

@@ -16,8 +16,8 @@
 # limitations under the License.
 # limitations under the License.
 
 
 import json
 import json
-import math
 import logging
 import logging
+import math
 
 
 from django.utils.translation import gettext as _
 from django.utils.translation import gettext as _
 
 
@@ -28,7 +28,7 @@ LOG = logging.getLogger()
 
 
 
 
 FETCH_SIZE = 1000
 FETCH_SIZE = 1000
-DOWNLOAD_COOKIE_AGE = 1800  # 30 minutes
+DOWNLOAD_COOKIE_AGE = None  # Session cookie - expires when browser closes
 
 
 
 
 def download(handle, format, db, id=None, file_name='query_result', user_agent=None):
 def download(handle, format, db, id=None, file_name='query_result', user_agent=None):
@@ -124,7 +124,7 @@ class DataAdapter(object):
         size += len(str(col))
         size += len(str(col))
       elif col_type is bool:
       elif col_type is bool:
         size += 4
         size += 4
-      elif col_type == type(None):
+      elif col_type is type(None):
         size += 4
         size += 4
       else:
       else:
         size += len(str(col))
         size += len(str(col))

+ 2 - 2
desktop/core/src/desktop/conf.py

@@ -1007,13 +1007,13 @@ SESSION = ConfigSection(
       key='expire_at_browser_close',
       key='expire_at_browser_close',
       help=_("Use session-length cookies. Logs out the user when she closes the browser window."),
       help=_("Use session-length cookies. Logs out the user when she closes the browser window."),
       type=coerce_bool,
       type=coerce_bool,
-      default=False
+      default=True
     ),
     ),
     CSRF_COOKIE_AGE=Config(
     CSRF_COOKIE_AGE=Config(
       key='csrf_cookie_age',
       key='csrf_cookie_age',
       help=_("CRSF cookie age defaults to 1 year. If the value is set to 0, it means per session. Time in seconds"),
       help=_("CRSF cookie age defaults to 1 year. If the value is set to 0, it means per session. Time in seconds"),
       type=int,
       type=int,
-      default=60 * 60 * 24 * 7 * 52,
+      default=0,
     ),
     ),
     CONCURRENT_USER_SESSION_LIMIT=Config(
     CONCURRENT_USER_SESSION_LIMIT=Config(
       key="concurrent_user_session_limit",
       key="concurrent_user_session_limit",

+ 2 - 1
desktop/core/src/desktop/templates/hue.mako

@@ -55,7 +55,8 @@
         send_page_view: false, 
         send_page_view: false, 
         page_location: 'redacted',
         page_location: 'redacted',
         page_referrer: 'redacted',
         page_referrer: 'redacted',
-        allow_google_signals: false
+        allow_google_signals: false,
+        cookie_expires: 0
         });
         });
     </script>
     </script>
   % endif
   % endif

+ 8 - 1
docs/docs-site/layouts/partials/custom-footer.html

@@ -5,5 +5,12 @@
   function gtag(){dataLayer.push(arguments);}
   function gtag(){dataLayer.push(arguments);}
   gtag('js', new Date());
   gtag('js', new Date());
 
 
-  gtag('config', 'UA-37637545-1');
+  gtag('config', '${ conf.GTAG_ID.get()}', {
+    // Prevent GA from accidentally passing client meta data present in urls
+    send_page_view: false, 
+    page_location: 'redacted',
+    page_referrer: 'redacted',
+    allow_google_signals: false,
+    cookie_expires: 0
+  });
 </script>
 </script>

+ 8 - 1
docs/gethue/themes/stack-hue-theme/layouts/partials/footer.html

@@ -74,7 +74,14 @@
   function gtag(){dataLayer.push(arguments);}
   function gtag(){dataLayer.push(arguments);}
   gtag('js', new Date());
   gtag('js', new Date());
 
 
-  gtag('config', 'UA-37637545-1');
+  gtag('config', '${ conf.GTAG_ID.get()}', {
+    // Prevent GA from accidentally passing client meta data present in urls
+    send_page_view: false, 
+    page_location: 'redacted',
+    page_referrer: 'redacted',
+    allow_google_signals: false,
+    cookie_expires: 0
+  });
 </script>
 </script>
 
 
 </body>
 </body>