github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-01-30 22:42:40 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

FEATURE: set secure flag on _t cookie if https is forced

Browse Source
This commit is contained in:
Sam 2016-10-17 12:11:15 +11:00
parent 6aa2e49be9
commit b246f1a694
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/auth/default_current_user_provider.rb
View File

@ -108,7 +108,7 @@ class Auth::DefaultCurrentUserProvider
if user && (!user.auth_token_updated_at || user.auth_token_updated_at <= 1.hour.ago) if user && (!user.auth_token_updated_at || user.auth_token_updated_at <= 1.hour.ago)
user.update_column(:auth_token_updated_at, Time.zone.now) user.update_column(:auth_token_updated_at, Time.zone.now)
cookies[TOKEN_COOKIE] = { value: user.auth_token, httponly: true, expires: SiteSetting.maximum_session_age.hours.from_now } cookies[TOKEN_COOKIE] = cookie_hash(user)
end end
if !user && cookies.key?(TOKEN_COOKIE) if !user && cookies.key?(TOKEN_COOKIE)
cookies.delete(TOKEN_COOKIE) cookies.delete(TOKEN_COOKIE)
@ -124,12 +124,21 @@ class Auth::DefaultCurrentUserProvider
auth_token_updated_at: Time.zone.now) auth_token_updated_at: Time.zone.now)
end end
cookies[TOKEN_COOKIE] = { value: user.auth_token, httponly: true, expires: SiteSetting.maximum_session_age.hours.from_now } cookies[TOKEN_COOKIE] = cookie_hash(user)
make_developer_admin(user) make_developer_admin(user)
enable_bootstrap_mode(user) enable_bootstrap_mode(user)
@env[CURRENT_USER_KEY] = user @env[CURRENT_USER_KEY] = user
end end
def cookie_hash(user)
{
value: user.auth_token,
httponly: true,
expires: SiteSetting.maximum_session_age.hours.from_now,
secure: SiteSetting.force_https
}
end
def make_developer_admin(user) def make_developer_admin(user)
if user.active? && if user.active? &&
!user.admin && !user.admin &&