[IMP] http: set HTTPonly flag on session cookie

This will reinforce the framework against potential XSS exploits
escalating to session hijack

1 files changed, 1 insertions, 4 deletions

diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js
index 033d7995c9c..84d3234d8ba 100644
--- a/addons/web/static/src/js/core/session.js
+++ b/addons/web/static/src/js/core/session.js
@@ -303,11 +303,8 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
             }).always(function () {
                 self.avoid_recursion = false;
             });
-        } else {
-            // normal use case, just use the cookie
-            self.session_id = utils.get_cookie("session_id");
-            return $.when();
         }
+        return $.when();
     },
     /**
      * Executes an RPC call, registering the provided callbacks.