浏览代码

[desktop] Change session cookie to not be accessible from javascript by default

Erick Tryzelaar 10 年之前
父节点
当前提交
c450bc65b7
共有 3 个文件被更改,包括 3 次插入3 次删除
  1. 1 1
      desktop/conf.dist/hue.ini
  2. 1 1
      desktop/conf/pseudo-distributed.ini.tmpl
  3. 1 1
      desktop/core/src/desktop/conf.py

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -420,7 +420,7 @@
     ## secure=false
 
     # The cookie containing the users' session ID will use the HTTP only flag.
-    ## http_only=false
+    ## http_only=true
 
     # Use session-length cookies. Logs out the user when she closes the browser window.
     ## expire_at_browser_close=false

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -427,7 +427,7 @@
     ## secure=false
 
     # The cookie containing the users' session ID will use the HTTP only flag.
-    ## http_only=false
+    ## http_only=true
 
     # Use session-length cookies. Logs out the user when she closes the browser window.
     ## expire_at_browser_close=false

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -386,7 +386,7 @@ SESSION = ConfigSection(
       key='http_only',
       help=_("The cookie containing the users' session ID will use the HTTP only flag."),
       type=coerce_bool,
-      default=False
+      default=True,
     ),
     EXPIRE_AT_BROWSER_CLOSE=Config(
       key='expire_at_browser_close',