Explorar el Código

[desktop] Default to using secure session cookies if HTTPS is enabled

This protects users that forget to enable secure sessions by default.
Erick Tryzelaar hace 10 años
padre
commit
d4eec80ec4
Se han modificado 2 ficheros con 56 adiciones y 1 borrados
  1. 6 1
      desktop/core/src/desktop/conf.py
  2. 50 0
      desktop/core/src/desktop/tests.py

+ 6 - 1
desktop/core/src/desktop/conf.py

@@ -250,6 +250,11 @@ def default_database_options():
     return {}
 
 
+def default_secure_cookie():
+  """Enable secure cookies if HTTPS is enabled."""
+  return is_https_enabled()
+
+
 SMTP = ConfigSection(
   key='smtp',
   help=_('Configuration options for connecting to an external SMTP server.'),
@@ -380,7 +385,7 @@ SESSION = ConfigSection(
       key='secure',
       help=_("The cookie containing the users' session ID will be secure. This should only be enabled with HTTPS."),
       type=coerce_bool,
-      default=False,
+      dynamic_default=default_secure_cookie,
     ),
     HTTP_ONLY=Config(
       key='http_only',

+ 50 - 0
desktop/core/src/desktop/tests.py

@@ -916,3 +916,53 @@ class TestDocument(object):
     # Test that copying enables attribute overrides
     assert_equal(Document.objects.filter(name=name).count(), 1)
     assert_equal(doc.description, self.document.description)
+
+
+def test_session_secure_cookie():
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(False),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_false(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(True),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_true(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(present=False),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_true(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing(present=None),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing(present=None),
+    desktop.conf.SESSION.SECURE.set_for_testing(present=False),
+  ]
+  try:
+    assert_false(desktop.conf.is_https_enabled())
+    assert_false(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()