Эх сурвалжийг харах

HUE-9518 [session] ability to change the csrf cookie age from default 1yr

Mahesh Balakrishnan 5 жил өмнө
parent
commit
bff9b896b4

+ 6 - 0
desktop/core/src/desktop/conf.py

@@ -823,6 +823,12 @@ SESSION = ConfigSection(
       type=coerce_bool,
       default=False
     ),
+    CSRF_COOKIE_AGE=Config(
+      key='csrf_cookie_age',
+      help=_("CRSF cookie age defaults to 1 year. If the value is set to 0, it means per session. Time in seconds"),
+      type=int,
+      default=60*60*24*7*52,
+    ),
     CONCURRENT_USER_SESSION_LIMIT=Config(
       key="concurrent_user_session_limit",
       help=_("If set, limits the number of concurrent user sessions. 1 represents 1 session per user. "

+ 1 - 0
desktop/core/src/desktop/settings.py

@@ -435,6 +435,7 @@ SESSION_EXPIRE_AT_BROWSER_CLOSE = desktop.conf.SESSION.EXPIRE_AT_BROWSER_CLOSE.g
 # HTTP only
 SESSION_COOKIE_HTTPONLY = desktop.conf.SESSION.HTTP_ONLY.get()
 
+CSRF_COOKIE_AGE = None if desktop.conf.SESSION.CSRF_COOKIE_AGE.get() == 0 else desktop.conf.SESSION.CSRF_COOKIE_AGE.get()
 CSRF_COOKIE_SECURE = desktop.conf.SESSION.SECURE.get()
 CSRF_COOKIE_HTTPONLY = desktop.conf.SESSION.HTTP_ONLY.get()
 CSRF_COOKIE_NAME = 'csrftoken'