Changeset - 70e29dc91deb
Parent rev.
Child rev.
[Not reviewed]
default
0 5 0
Thomas De Schampheleire - 11 years ago 2015-03-10 20:00:41
thomas.de.schampheleire@gmail.com
ini file: clarify that beaker.session.key should be unique

When several instances of Kallithea are running on the same machine, the
same browser cannot be logged into both instances at the same time without
conflicts. The login session are saved into the same cookie; logging into
one instance closes the session on the second instance and vice-versa.

This is caused because the cookie name is simply 'kallithea', combined with
the fact that the cookie specification (RFC6265) states that there is no
isolation of cookies based on port. This means that the browser sends all
cookies from a given domain with all services (Kallithea instances) running
on that domain, irrespective of port.

The services thus need to handle any such issue themselves, for example by
using unique cookie names and only interacting with one's own cookie.

Making the key unique when creating the configuration file proved difficult:
- it does not seem possible to hook into 'paster make-config'
- since Beaker directly interprets the beaker.session.key, changing it on
the fly from SessionMiddleware will not work correctly.

There is a kallithea-config script that is an alternative to 'paster
make-config' which would be the ideal place to make such changes. However,
it seems this method is not advocated over 'paster make-config' (yet?).

Instead, simply add a comment in the config file and let the user take care
of it.
5 files changed with 12 insertions and 0 deletions:
development.ini
2
kallithea/bin/template.ini.mako
4
kallithea/config/deployment.ini_tmpl
2
production.ini
2
test.ini
2
0 comments (0 inline, 0 general)
development.ini
➞
Show inline comments
 
@@ -342,24 +342,26 @@ beaker.cache.sql_cache_long.key_length =
 

			




	
	
	
		
 
## db session ##

			




	
	
	
		
 
#beaker.session.type = ext:database

			




	
	
	
		
 
#beaker.session.sa.url = postgresql://postgres:qwe@localhost/kallithea

			




	
	
	
		
 
#beaker.session.table_name = db_session

			




	
	
	
		
 

			




	
	
	
		
 
## encrypted cookie client side session, good for many instances ##

			




	
	
	
		
 
#beaker.session.type = cookie

			




	
	
	
		
 

			




	
	
	
		
 
## file based cookies (default) ##

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
## beaker.session.key should be unique for a given host, even when running

			




	
	
	
		
 
## on different ports. Otherwise, cookie sessions will be shared and messed up.

			




	
	
	
		
 
beaker.session.key = kallithea

			




	
	
	
		
 
beaker.session.secret = development-not-secret

			




	
	
	
		
 

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




	
	
	
		
 
## sets session as invalid if it haven't been accessed for given amount of time

			




	
	
	
		
 
beaker.session.timeout = 2592000

			




	
	
	
		
 
beaker.session.httponly = true

			




	
	
	
		
 
#beaker.session.cookie_path = /<your-prefix>

			




        

    


    
    

    

        

                

                    kallithea/bin/template.ini.mako
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -339,24 +339,28 @@ beaker.cache.sql_cache_long.key_length =

			




	
	
	
		
 
</%text>

			




	
	
	
		
 
<%text>## db session ##</%text>

			




	
	
	
		
 
#beaker.session.type = ext:database

			




	
	
	
		
 
#beaker.session.sa.url = postgresql://postgres:qwe@localhost/kallithea

			




	
	
	
		
 
#beaker.session.table_name = db_session

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## encrypted cookie client side session, good for many instances ##</%text>

			




	
	
	
		
 
#beaker.session.type = cookie

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## file based cookies (default) ##</%text>

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
<%text>

			




	
	
	
		
 
## beaker.session.key should be unique for a given host, even when running

			




	
	
	
		
 
## on different ports. Otherwise, cookie sessions will be shared and messed up.

			




	
	
	
		
 
</%text>

			




	
	
	
		
 
beaker.session.key = kallithea

			




	
	
	
		
 
beaker.session.secret = ${uuid()}

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## Secure encrypted cookie. Requires AES and AES python libraries</%text>

			




	
	
	
		
 
<%text>## you must disable beaker.session.secret to use this</%text>

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




	
	
	
		
 
<%text>## sets session as invalid if it haven't been accessed for given amount of time</%text>

			




	
	
	
		
 
beaker.session.timeout = 2592000

			




	
	
	
		
 
beaker.session.httponly = true

			




	
	
	
		
 
#beaker.session.cookie_path = /<your-prefix>

			




        

    


    
    

    

        

                

                    kallithea/config/deployment.ini_tmpl
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -336,24 +336,26 @@ beaker.cache.sql_cache_long.key_length =

			




	
	
	
		
 

			




	
	
	
		
 
## db session ##

			




	
	
	
		
 
#beaker.session.type = ext:database

			




	
	
	
		
 
#beaker.session.sa.url = postgresql://postgres:qwe@localhost/kallithea

			




	
	
	
		
 
#beaker.session.table_name = db_session

			




	
	
	
		
 

			




	
	
	
		
 
## encrypted cookie client side session, good for many instances ##

			




	
	
	
		
 
#beaker.session.type = cookie

			




	
	
	
		
 

			




	
	
	
		
 
## file based cookies (default) ##

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
## beaker.session.key should be unique for a given host, even when running

			




	
	
	
		
 
## on different ports. Otherwise, cookie sessions will be shared and messed up.

			




	
	
	
		
 
beaker.session.key = kallithea

			




	
	
	
		
 
beaker.session.secret = ${app_instance_uuid}

			




	
	
	
		
 

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




	
	
	
		
 
## sets session as invalid if it haven't been accessed for given amount of time

			




	
	
	
		
 
beaker.session.timeout = 2592000

			




	
	
	
		
 
beaker.session.httponly = true

			




	
	
	
		
 
#beaker.session.cookie_path = /<your-prefix>

			




        

    


    
    

    

        

                

                    production.ini
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -340,24 +340,26 @@ beaker.cache.sql_cache_long.key_length =

			




	
	
	
		
 

			




	
	
	
		
 
## db session ##

			




	
	
	
		
 
#beaker.session.type = ext:database

			




	
	
	
		
 
#beaker.session.sa.url = postgresql://postgres:qwe@localhost/kallithea

			




	
	
	
		
 
#beaker.session.table_name = db_session

			




	
	
	
		
 

			




	
	
	
		
 
## encrypted cookie client side session, good for many instances ##

			




	
	
	
		
 
#beaker.session.type = cookie

			




	
	
	
		
 

			




	
	
	
		
 
## file based cookies (default) ##

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
## beaker.session.key should be unique for a given host, even when running

			




	
	
	
		
 
## on different ports. Otherwise, cookie sessions will be shared and messed up.

			




	
	
	
		
 
beaker.session.key = kallithea

			




	
	
	
		
 
beaker.session.secret = change-me

			




	
	
	
		
 

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




	
	
	
		
 
## sets session as invalid if it haven't been accessed for given amount of time

			




	
	
	
		
 
beaker.session.timeout = 2592000

			




	
	
	
		
 
beaker.session.httponly = true

			




	
	
	
		
 
#beaker.session.cookie_path = /<your-prefix>

			




        

    


    
    

    

        

                

                    test.ini
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -342,24 +342,26 @@ beaker.cache.sql_cache_long.key_length =

			




	
	
	
		
 

			




	
	
	
		
 
## db session ##

			




	
	
	
		
 
#beaker.session.type = ext:database

			




	
	
	
		
 
#beaker.session.sa.url = postgresql://postgres:qwe@localhost/kallithea

			




	
	
	
		
 
#beaker.session.table_name = db_session

			




	
	
	
		
 

			




	
	
	
		
 
## encrypted cookie client side session, good for many instances ##

			




	
	
	
		
 
#beaker.session.type = cookie

			




	
	
	
		
 

			




	
	
	
		
 
## file based cookies (default) ##

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
## beaker.session.key should be unique for a given host, even when running

			




	
	
	
		
 
## on different ports. Otherwise, cookie sessions will be shared and messed up.

			




	
	
	
		
 
beaker.session.key = kallithea

			




	
	
	
		
 
beaker.session.secret = {74e0cd75-b339-478b-b129-07dd221def1f}

			




	
	
	
		
 

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




	
	
	
		
 
## sets session as invalid if it haven't been accessed for given amount of time

			




	
	
	
		
 
beaker.session.timeout = 2592000

			




	
	
	
		
 
beaker.session.httponly = true

			




	
	
	
		
 
#beaker.session.cookie_path = /<your-prefix>

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.