Mercurial > p > roundup > code
comparison doc/upgrading.txt @ 5212:d4cc71beb102
Added support for SameSite cookie option for CSRF prevention
This was an easy addon compared to the complexity of the CSRF nonce
support. It only works in chromium browsers (Chrome, Opera...) at
the moment. But there is recent activity on implementing it in
firefox. Who know when edge/ie will adopt it. So csrf nonce and
header analysis will be needed for a while.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sun, 19 Mar 2017 19:01:41 -0400 |
| parents | a9ace22e0a2f |
| children | 64ae2108df60 |
comparison
equal
deleted
inserted
replaced
| 5211:f4b6a2a3e605 | 5212:d4cc71beb102 |
|---|---|
| 98 missing. | 98 missing. |
| 99 | 99 |
| 100 It is suggested that you change your templates so every form | 100 It is suggested that you change your templates so every form |
| 101 has an @csrf field and change the setting to 'required' for | 101 has an @csrf field and change the setting to 'required' for |
| 102 the csrf_enforce_token. | 102 the csrf_enforce_token. |
| 103 | |
| 104 Support for SameSite cookie option for session cookie | |
| 105 ----------------------------------------------------- | |
| 106 | |
| 107 Support for serving the session cookie using the SameSite cookie option | |
| 108 has been added. By default it is set to lax to provide a better user | |
| 109 experience. But this can be changes to strict or the option can be | |
| 110 removed entirely. | |
| 111 | |
| 112 Using the process for merging config.ini changes described in | |
| 113 `Cross Site Request Forgery Detection Added`_ you can add the | |
| 114 ``samesite_cookie_setting`` to the ``[web]`` section of the config | |
| 115 file. | |
| 103 | 116 |
| 104 Fix for path traversal changes template resolution | 117 Fix for path traversal changes template resolution |
| 105 -------------------------------------------------- | 118 -------------------------------------------------- |
| 106 | 119 |
| 107 The templates in the tracker's html subdirectory must not be | 120 The templates in the tracker's html subdirectory must not be |