瀏覽代碼

[cookies] cookies to expire at browser closing

Our `sessionid` cookie has a 14 days of expiry. This means that if a
user forgets to click logout button and instead just closes the browser
window, they remain signed in. This is a security hole, especially if
the computer is used by multiple people. Someone else can gain access
to the previous user's data.

This commits sets the default age of `sessionid` and `csrftoken` to `0`.
This will make these cookies non-persistent and held only in memory.
These cookies will get cleared on browser restart.

In addition, this commit also enforces the same for google analytics
cookies.
Amit Srivastava 3 月之前
父節點
當前提交
77bad76e3d

+ 3 - 3
apps/beeswax/src/beeswax/data_export.py

@@ -16,8 +16,8 @@
 # limitations under the License.
 
 import json
-import math
 import logging
+import math
 
 from django.utils.translation import gettext as _
 
@@ -28,7 +28,7 @@ LOG = logging.getLogger()
 
 
 FETCH_SIZE = 1000
-DOWNLOAD_COOKIE_AGE = 1800  # 30 minutes
+DOWNLOAD_COOKIE_AGE = None  # Session cookie - expires when browser closes
 
 
 def download(handle, format, db, id=None, file_name='query_result', user_agent=None):
@@ -124,7 +124,7 @@ class DataAdapter(object):
         size += len(str(col))
       elif col_type is bool:
         size += 4
-      elif col_type == type(None):
+      elif col_type is type(None):
         size += 4
       else:
         size += len(str(col))

+ 2 - 2
desktop/core/src/desktop/conf.py

@@ -1007,13 +1007,13 @@ SESSION = ConfigSection(
       key='expire_at_browser_close',
       help=_("Use session-length cookies. Logs out the user when she closes the browser window."),
       type=coerce_bool,
-      default=False
+      default=True
     ),
     CSRF_COOKIE_AGE=Config(
       key='csrf_cookie_age',
       help=_("CRSF cookie age defaults to 1 year. If the value is set to 0, it means per session. Time in seconds"),
       type=int,
-      default=60 * 60 * 24 * 7 * 52,
+      default=0,
     ),
     CONCURRENT_USER_SESSION_LIMIT=Config(
       key="concurrent_user_session_limit",

+ 2 - 1
desktop/core/src/desktop/templates/hue.mako

@@ -55,7 +55,8 @@
         send_page_view: false, 
         page_location: 'redacted',
         page_referrer: 'redacted',
-        allow_google_signals: false
+        allow_google_signals: false,
+        cookie_expires: 0
         });
     </script>
   % endif

+ 8 - 1
docs/docs-site/layouts/partials/custom-footer.html

@@ -5,5 +5,12 @@
   function gtag(){dataLayer.push(arguments);}
   gtag('js', new Date());
 
-  gtag('config', 'UA-37637545-1');
+  gtag('config', '${ conf.GTAG_ID.get()}', {
+    // Prevent GA from accidentally passing client meta data present in urls
+    send_page_view: false, 
+    page_location: 'redacted',
+    page_referrer: 'redacted',
+    allow_google_signals: false,
+    cookie_expires: 0
+  });
 </script>

+ 8 - 1
docs/gethue/themes/stack-hue-theme/layouts/partials/footer.html

@@ -74,7 +74,14 @@
   function gtag(){dataLayer.push(arguments);}
   gtag('js', new Date());
 
-  gtag('config', 'UA-37637545-1');
+  gtag('config', '${ conf.GTAG_ID.get()}', {
+    // Prevent GA from accidentally passing client meta data present in urls
+    send_page_view: false, 
+    page_location: 'redacted',
+    page_referrer: 'redacted',
+    allow_google_signals: false,
+    cookie_expires: 0
+  });
 </script>
 
 </body>