Changeset - c9ca7fa55b0d
Parent rev.
Child rev.
[Not reviewed]
beta
0 3 0
Marcin Kuzminski - 12 years ago 2013-06-07 19:23:20
marcin@python-works.com
Fill session cookie secret with random generated app_uuid.
By default this setup is much more secure since it uses
SignedCookies instead of plain ones
3 files changed with 12 insertions and 6 deletions:
development.ini
4
2
production.ini
4
2
rhodecode/config/deployment.ini_tmpl
4
2
0 comments (0 inline, 0 general)
development.ini
➞
Show inline comments
 
@@ -293,9 +293,11 @@ beaker.cache.sql_cache_long.key_length =
 
## file based cookies (default) ##
 
#beaker.session.type = file
 

			




	
	
	
		
 
beaker.session.key = rhodecode

			




	
	
	
		
 
beaker.session.secret = ${app_instance_uuid}

			




	
	
	
		
 

			




	
	
	
		
 
beaker.session.key = rhodecode

			




	
	
	
		
 
## secure cookie requires AES python libraries

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    production.ini
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -293,9 +293,11 @@ beaker.cache.sql_cache_long.key_length =

			




	
	
	
		
 
## file based cookies (default) ##

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
beaker.session.key = rhodecode

			




	
	
	
		
 
beaker.session.secret = ${app_instance_uuid}

			




	
	
	
		
 

			




	
	
	
		
 
beaker.session.key = rhodecode

			




	
	
	
		
 
## secure cookie requires AES python libraries

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    rhodecode/config/deployment.ini_tmpl
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -293,9 +293,11 @@ beaker.cache.sql_cache_long.key_length =

			




	
	
	
		
 
## file based cookies (default) ##

			




	
	
	
		
 
#beaker.session.type = file

			




	
	
	
		
 

			




	
	
	
		
 
beaker.session.key = rhodecode

			




	
	
	
		
 
beaker.session.secret = ${app_instance_uuid}

			




	
	
	
		
 

			




	
	
	
		
 
beaker.session.key = rhodecode

			




	
	
	
		
 
## secure cookie requires AES python libraries

			




	
	
	
		
 
## Secure encrypted cookie. Requires AES and AES python libraries

			




	
	
	
		
 
## you must disable beaker.session.secret to use this

			




	
	
	
		
 
#beaker.session.encrypt_key = <key_for_encryption>

			




	
	
	
		
 
#beaker.session.validate_key = <validation_key>

			




	
	
	
		
 

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.