Browse Source

[desktop] Default to using secure session cookies if HTTPS is enabled

This protects users that forget to enable secure sessions by default.
Erick Tryzelaar 10 năm trước cách đây
mục cha
commit
d4eec80ec4
2 tập tin đã thay đổi với 56 bổ sung1 xóa
  1. 6 1
      desktop/core/src/desktop/conf.py
  2. 50 0
      desktop/core/src/desktop/tests.py

+ 6 - 1
desktop/core/src/desktop/conf.py

@@ -250,6 +250,11 @@ def default_database_options():
     return {}
 
 
+def default_secure_cookie():
+  """Enable secure cookies if HTTPS is enabled."""
+  return is_https_enabled()
+
+
 SMTP = ConfigSection(
   key='smtp',
   help=_('Configuration options for connecting to an external SMTP server.'),
@@ -380,7 +385,7 @@ SESSION = ConfigSection(
       key='secure',
       help=_("The cookie containing the users' session ID will be secure. This should only be enabled with HTTPS."),
       type=coerce_bool,
-      default=False,
+      dynamic_default=default_secure_cookie,
     ),
     HTTP_ONLY=Config(
       key='http_only',

+ 50 - 0
desktop/core/src/desktop/tests.py

@@ -916,3 +916,53 @@ class TestDocument(object):
     # Test that copying enables attribute overrides
     assert_equal(Document.objects.filter(name=name).count(), 1)
     assert_equal(doc.description, self.document.description)
+
+
+def test_session_secure_cookie():
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(False),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_false(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(True),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_true(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing('cert.pem'),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing('key.pem'),
+    desktop.conf.SESSION.SECURE.set_for_testing(present=False),
+  ]
+  try:
+    assert_true(desktop.conf.is_https_enabled())
+    assert_true(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()
+
+  resets = [
+    desktop.conf.SSL_CERTIFICATE.set_for_testing(present=None),
+    desktop.conf.SSL_PRIVATE_KEY.set_for_testing(present=None),
+    desktop.conf.SESSION.SECURE.set_for_testing(present=False),
+  ]
+  try:
+    assert_false(desktop.conf.is_https_enabled())
+    assert_false(desktop.conf.SESSION.SECURE.get())
+  finally:
+    for reset in resets:
+      reset()