dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1046 from ShySec/master

Browse Source 
added default HttpOnly cookies
This commit is contained in:
mdipierro
2015-08-18 11:53:54 -05:00
parent 93237837ed cf20ce5fae
commit 47c0e461f1
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/globals.py
+9 -3
View File
@@ -1023,10 +1023,16 @@ class Session(Storage):
def _fixup_before_save(self): def _fixup_before_save(self):
response = current.response response = current.response
rcookies = response.cookies rcookies = response.cookies
if self._forget and response.session_id_name in rcookies: scookies = rcookies.get(response.session_id_name)
if not scookies:
return
if self._forget:
del rcookies[response.session_id_name] del rcookies[response.session_id_name]
elif self._secure and response.session_id_name in rcookies: return
rcookies[response.session_id_name]['secure'] = True if self.get('httponly_cookies',True):
scookies['HttpOnly'] = True
if self._secure:
scookies['secure'] = True
def clear_session_cookies(self): def clear_session_cookies(self):
request = current.request request = current.request