فهرست منبع

[desktop] Default to using secure session cookies if HTTPS is enabled

This protects users that forget to enable secure sessions by default.
Erick Tryzelaar 10 سال پیش
والد
کامیت
d4eec80
2فایلهای تغییر یافته به همراه56 افزوده شده و 1 حذف شده
  1. 6 1
      desktop/core/src/desktop/conf.py
  2. 50 0
      desktop/core/src/desktop/tests.py

+ 6 - 1
desktop/core/src/desktop/conf.py

@@ -250,6 +250,11 @@ def default_database_options():
     return {}
 
 
+def default_secure_cookie():
+  """Enable secure cookies if HTTPS is enabled."""
+  return is_https_enabled()
+
+
 SMTP = ConfigSection(
   key='smtp',
   help=_('Configuration options for connecting to an external SMTP server.'),
@@ -380,7 +385,7 @@ SESSION = ConfigSection(
       key='secure',
       help=_("The cookie containing the users' session ID will be secure. This should only be enabled with HTTPS."),
       type=coerce_bool,
-      default=False,
+      dynamic_default=default_secure_cookie,
     ),
     HTTP_ONLY=Config(
       key='http_only',

+ 50 - 0
desktop/core/src/desktop/tests.py

@@ -916,3 +916,53 @@ class TestDocument(object):
     # Test that copying enables attribute overrides
     assert_equal(Document.objects.filter(name=name).count(), 1)
     assert_equal(doc.description, self.document.description)
+
+
+def test_session_secure_cookie():
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(False),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_false(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(True),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_true(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(present=False),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_true(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing(present=None),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing(present=None),
+    desktop.conf.SESSION.SECURE.set_for_testing(present=False),
+  ]
+  try:
+    assert_false(desktop.conf.is_https_enabled())
+    assert_false(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()