From f4d541e51abd7fcb3cd17d3e023b3132b9293d2a Mon Sep 17 00:00:00 2001
From: Olivier Dony <odo@openerp.com>
Date: Tue, 5 Sep 2017 01:26:15 +0200
Subject: [IMP] http: set HTTPonly flag on session cookie

This will reinforce the framework against potential XSS exploits
escalating to session hijack
---
 addons/web/static/src/js/core/session.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

(limited to 'addons/web/static/src/js/core/session.js')

diff --git a/addons/web/static/src/js/core/session.js b/addons/web/static/src/js/core/session.js
index 033d7995c9c..84d3234d8ba 100644
--- a/addons/web/static/src/js/core/session.js
+++ b/addons/web/static/src/js/core/session.js
@@ -303,11 +303,8 @@ var Session = core.Class.extend(mixins.EventDispatcherMixin, {
             }).always(function () {
                 self.avoid_recursion = false;
             });
-        } else {
-            // normal use case, just use the cookie
-            self.session_id = utils.get_cookie("session_id");
-            return $.when();
         }
+        return $.when();
     },
     /**
      * Executes an RPC call, registering the provided callbacks.
-- 
cgit v1.2.3