diff options
| author | Olivier Dony <odo@openerp.com> | 2017-09-05 01:26:15 +0200 |
|---|---|---|
| committer | Olivier Dony <odo@openerp.com> | 2017-09-05 10:06:35 +0200 |
| commit | f4d541e51abd7fcb3cd17d3e023b3132b9293d2a (patch) | |
| tree | c145d072bb16b513e0077f73bd2b21ba9a430489 /odoo/http.py | |
| parent | 84f0e84d14ee273d199690a4ebefa7a6cd95e949 (diff) | |
[IMP] http: set HTTPonly flag on session cookie
This will reinforce the framework against potential XSS exploits
escalating to session hijack
Diffstat (limited to 'odoo/http.py')
| -rw-r--r-- | odoo/http.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/odoo/http.py b/odoo/http.py index 14dfc6c89f5..e0ffe58c4c7 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -1420,7 +1420,8 @@ class Root(object): # (the one using the cookie). That is a special feature of the Session Javascript class. # - It could allow session fixation attacks. if not explicit_session and hasattr(response, 'set_cookie'): - response.set_cookie('session_id', httprequest.session.sid, max_age=90 * 24 * 60 * 60) + response.set_cookie( + 'session_id', httprequest.session.sid, max_age=90 * 24 * 60 * 60, httponly=True) return response |