From 52c291621561857629d2606bfd61452adfdbb6ce Mon Sep 17 00:00:00 2001 From: Thomas Waldmann Date: Sun, 3 Nov 2013 10:19:05 +0100 Subject: [PATCH] add docs about secure cookies --- docs/security.rst | 3 +++ nsupdate/settings.py | 4 ++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/docs/security.rst b/docs/security.rst index 46a5b22..b43789e 100644 --- a/docs/security.rst +++ b/docs/security.rst @@ -102,6 +102,9 @@ The software ("as is") uses these cookies: * "sessionid" (host-only, to keep the session when you have logged-in to the web interface) +If you have set WE_HAVE_SSL to True (because you run the software on a https +site), you should also set *_COOKIE_SECURE to True to avoid the cookies getting +transmitted via http. Be careful with domain cookies ------------------------------ diff --git a/nsupdate/settings.py b/nsupdate/settings.py index 4e86039..ab915fa 100644 --- a/nsupdate/settings.py +++ b/nsupdate/settings.py @@ -224,13 +224,13 @@ CSRF_FAILURE_VIEW = 'nsupdate.main.views.CsrfFailureView' # Settings for CSRF cookie. CSRF_COOKIE_NAME = 'csrftoken' CSRF_COOKIE_PATH = '/' -CSRF_COOKIE_SECURE = False +CSRF_COOKIE_SECURE = False # use True here if you have set WE_HAVE_SSL = True CSRF_COOKIE_HTTPONLY = False # Settings for session cookie. SESSION_COOKIE_NAME = 'sessionid' SESSION_COOKIE_PATH = '/' -SESSION_COOKIE_SECURE = False +SESSION_COOKIE_SECURE = False # use True here if you have set WE_HAVE_SSL = True SESSION_COOKIE_HTTPONLY = True SESSION_COOKIE_AGE = 14 * 24 * 3600 # 2 weeks, in seconds SESSION_EXPIRE_AT_BROWSER_CLOSE = False