[IMP] web, *: remove explicit references to `session_id`

Since rev. odoo/odoo@f4d541e the `session_id` cookie uses the `httponly` flag so
it cannot be accessed through client side script. But before this rev. the
`session_id` was still provided by the server to the webclient (in session_info,
mostly) and was stored and accessible. This made XSS injection more
dangerous than they should be as it was very easy to steal the `session_id`.

As the browser automatically set the `session_id` on every request to the server,
the webclient shouldn't need any explicit reference.

1 files changed, 0 insertions, 2 deletions

diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js
index 694285cccdc..968496c2a6d 100644
--- a/addons/web/static/src/js/core/session.js
+++ b/addons/web/static/src/js/core/session.js
@@ -139,7 +139,6 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
             if (!result.uid) {
                 return $.Deferred().reject();
             }
-            delete result.session_id;
             _.extend(self, result);
         });
     },
@@ -290,7 +289,6 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
      */
     session_reload: function () {
         var result = _.extend({}, window.odoo.session_info);
-        delete result.session_id;
         _.extend(this, result);
         return $.when();
     },