diff options
| author | Olivier Dony <odo@openerp.com> | 2017-09-05 01:26:15 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2017-09-05 10:06:35 +0200 |
| commit | f4d541e51abd7fcb3cd17d3e023b3132b9293d2a (patch) | |
| tree | c145d072bb16b513e0077f73bd2b21ba9a430489 /addons/web/static/src/js/core/session.js | |
| parent | 84f0e84d14ee273d199690a4ebefa7a6cd95e949 (diff) | |
[IMP] http: set HTTPonly flag on session cookie
This will reinforce the framework against potential XSS exploits
escalating to session hijack
Diffstat (limited to 'addons/web/static/src/js/core/session.js')
| -rw-r--r-- | addons/web/static/src/js/core/session.js | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js index 033d7995c9c..84d3234d8ba 100644 --- a/addons/web/static/src/js/core/session.js +++ b/addons/web/static/src/js/core/session.js @@ -303,11 +303,8 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, { }).always(function () { self.avoid_recursion = false; }); - } else { - // normal use case, just use the cookie - self.session_id = utils.get_cookie("session_id"); - return $.when(); } + return $.when(); }, /** * Executes an RPC call, registering the provided callbacks. |