[allura] branch kt/8362 created (now ccf3da3)

[ke...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

kentontaylor pushed a change to branch kt/8362
in repository https://gitbox.apache.org/repos/asf/allura.git.


      at ccf3da3  [#8362] Add secure attr to session cookie

This branch includes the following new commits:

     new ccf3da3  [#8362] Add secure attr to session cookie

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

[allura] 01/01: [#8362] Add secure attr to session cookie

[ke...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

kentontaylor pushed a commit to branch kt/8362
in repository https://gitbox.apache.org/repos/asf/allura.git

commit ccf3da38db2d033bfa9e32f0bf57da9c8b3d6bb3
Author: Kenton Taylor <kt...@slashdotmedia.com>
AuthorDate: Fri May 29 14:54:13 2020 +0000

    [#8362] Add secure attr to session cookie
---
 Allura/allura/lib/custom_middleware.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Allura/allura/lib/custom_middleware.py b/Allura/allura/lib/custom_middleware.py
index 1b21f92..521ad05 100644
--- a/Allura/allura/lib/custom_middleware.py
+++ b/Allura/allura/lib/custom_middleware.py
@@ -216,7 +216,7 @@ class CSRFMiddleware(object):
             if dict(headers).get('Content-Type', '').startswith('text/html'):
                 headers.append(
                     (str('Set-cookie'),
-                     str('%s=%s; Path=/' % (self._cookie_name, cookie))))
+                     str('%s=%s; secure; Path=/' % (self._cookie_name, cookie))))
             return start_response(status, headers, exc_info)
 
         return self._app(environ, session_start_response)