kallithea Files · MANIFEST.in

Files @ 43ad9c3b7d5d

Branch filter:

Location: kallithea/MANIFEST.in

43ad9c3b7d5d 856 B text/plain Show Annotation Show as Raw Download as Raw

Andrew Shadura

middleware: use secure cookies over secure connections

HTTP cookie spec defines secure cookies, which are transmitted only over secure
connections (HTTPS). Using them helps protect against some attacks, but cookies
shouldn't be made secure when we don't have HTTPS configured. As it is now, it's
left at user's discretion, but probably it's a good idea to force secure cookies
when they can be used.

In the current implementation, cookies are issued to users before they actually
try to log in, on the first page load. So if that happens over HTTPS, it's
probably safe to assume secure cookies can be used, and to default to normal
"insecure" cookies if HTTPS isn't available.

It's not easy to sneak into Beaker's internals, and it doesn't support selective
secureness, so we use our own wrapper around Beaker's SessionMiddleware class to
give secure cookies over HTTPS connections. Beaker's built-in mechanism for
secure cookies is forced to add the flag when needed only.

include           Apache-License-2.0.txt
include           CONTRIBUTORS
include           COPYING
include           LICENSE-MERGELY.html
include           LICENSE.md
include           MIT-Permissive-License.txt
include           README.rst
include           development.ini
recursive-include docs *
recursive-include init.d *
include           kallithea/bin/ldap_sync.conf
include           kallithea/bin/template.ini.mako
include           kallithea/config/deployment.ini_tmpl
recursive-include kallithea/i18n *
recursive-include kallithea/lib/dbmigrate *.py_tmpl README migrate.cfg
recursive-include kallithea/public *
recursive-include kallithea/templates *
recursive-include kallithea/tests/fixtures *
recursive-include kallithea/tests/scripts *
include           kallithea/tests/vcs/aconfig
include           production.ini
include           test.ini