diff options
| -rw-r--r-- | addons/web/static/src/js/core/session.js | 5 | ||||
| -rw-r--r-- | odoo/http.py | 3 |
2 files changed, 3 insertions, 5 deletions
diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js index 033d7995c9c..84d3234d8ba 100644 --- a/addons/web/static/src/js/core/session.js +++ b/addons/web/static/src/js/core/session.js @@ -303,11 +303,8 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, { }).always(function () { self.avoid_recursion = false; }); - } else { - // normal use case, just use the cookie - self.session_id = utils.get_cookie("session_id"); - return $.when(); } + return $.when(); }, /** * Executes an RPC call, registering the provided callbacks. diff --git a/odoo/http.py b/odoo/http.py index 14dfc6c89f5..e0ffe58c4c7 100644 --- a/odoo/http.py +++ b/odoo/http.py @@ -1420,7 +1420,8 @@ class Root(object): # (the one using the cookie). That is a special feature of the Session Javascript class. # - It could allow session fixation attacks. if not explicit_session and hasattr(response, 'set_cookie'): - response.set_cookie('session_id', httprequest.session.sid, max_age=90 * 24 * 60 * 60) + response.set_cookie( + 'session_id', httprequest.session.sid, max_age=90 * 24 * 60 * 60, httponly=True) return response |