Mercurial > p > roundup > code
diff roundup/cgi/client.py @ 8168:3f0f4746dc7e
issue2551370 - prefix session cookie with __Secure- over https
Limit use of roundup session cookie to HTTPS protocol by adding
__Secure- prefix. Automatic testing includes http behavior only.
Https behavious has been manually tested only. Need to be able to spin
up an https server using wsgiref to test https behavior in CI.
issue 2551373 opened to track automatic testing of https behavior.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 26 Nov 2024 17:11:13 -0500 |
| parents | 0e01299414a8 |
| children | bd628e64725f |
line wrap: on
line diff
--- a/roundup/cgi/client.py Tue Nov 26 15:25:01 2024 -0500 +++ b/roundup/cgi/client.py Tue Nov 26 17:11:13 2024 -0500 @@ -190,8 +190,12 @@ self.session_db = client.db.getSessionManager() # parse cookies for session id - self.cookie_name = 'roundup_session_%s' % \ - re.sub('[^a-zA-Z]', '', client.instance.config.TRACKER_NAME) + if self.client.secure: + cookie_template = '__Secure-roundup_session_%s' + else: + cookie_template = 'roundup_session_%s' + self.cookie_name = cookie_template % \ + re.sub('[^a-zA-Z]', '', client.instance.config.TRACKER_NAME) cookies = LiberalCookie(client.env.get('HTTP_COOKIE', '')) if self.cookie_name in cookies: try: