alyssa
/
pleroma
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'security/cookie-hardening' into 'develop' 

Add __Host- prefix when secure flag is enabled

See merge request pleroma/pleroma!446
This commit is contained in:
lambda 2018-11-13 13:23:04 +00:00
parent c3f562a611 87c76a9a2f
commit 22d20c497b
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
lib/pleroma/web/endpoint.ex
View File

@ -46,13 +46,18 @@ defmodule Pleroma.Web.Endpoint do
plug(Plug.MethodOverride) plug(Plug.MethodOverride)
plug(Plug.Head) plug(Plug.Head)
cookie_name =
if Application.get_env(:pleroma, Pleroma.Web.Endpoint) |> Keyword.get(:secure_cookie_flag),
do: "__Host-pleroma_key",
else: "pleroma_key"
# The session will be stored in the cookie and signed, # The session will be stored in the cookie and signed,
# this means its contents can be read but not tampered with. # this means its contents can be read but not tampered with.
# Set :encryption_salt if you would also like to encrypt it. # Set :encryption_salt if you would also like to encrypt it.
plug( plug(
Plug.Session, Plug.Session,
store: :cookie, store: :cookie,
key: "_pleroma_key", key: cookie_name,
signing_salt: "CqaoopA2", signing_salt: "CqaoopA2",
http_only: true, http_only: true,
secure: secure: