Pārlūkot izejas kodu

[desktop] Change session cookie to not be accessible from javascript by default

Erick Tryzelaar 10 gadi atpakaļ
vecāks
revīzija
c450bc6

+ 1 - 1
desktop/conf.dist/hue.ini

@@ -420,7 +420,7 @@
     ## secure=false
 
     # The cookie containing the users' session ID will use the HTTP only flag.
-    ## http_only=false
+    ## http_only=true
 
     # Use session-length cookies. Logs out the user when she closes the browser window.
     ## expire_at_browser_close=false

+ 1 - 1
desktop/conf/pseudo-distributed.ini.tmpl

@@ -427,7 +427,7 @@
     ## secure=false
 
     # The cookie containing the users' session ID will use the HTTP only flag.
-    ## http_only=false
+    ## http_only=true
 
     # Use session-length cookies. Logs out the user when she closes the browser window.
     ## expire_at_browser_close=false

+ 1 - 1
desktop/core/src/desktop/conf.py

@@ -386,7 +386,7 @@ SESSION = ConfigSection(
       key='http_only',
       help=_("The cookie containing the users' session ID will use the HTTP only flag."),
       type=coerce_bool,
-      default=False
+      default=True,
     ),
     EXPIRE_AT_BROWSER_CLOSE=Config(
       key='expire_at_browser_close',