diff options
| author | Simon Brandhof <simon.brandhof@gmail.com> | 2013-08-14 17:27:45 +0200 |
|---|---|---|
| committer | Simon Brandhof <simon.brandhof@gmail.com> | 2013-08-14 17:27:56 +0200 |
| commit | adde7cf9216f9a0ccf78409078838d826d816f4a (patch) | |
| tree | c7a8fd734ec8f3c58a00a2e4ebfe0385f1d952ec | |
| parent | 3597f9be9723a060fd850aef52a138d8a49a6a7f (diff) | |
| download | sonarqube-adde7cf9216f9a0ccf78409078838d826d816f4a.tar.gz sonarqube-adde7cf9216f9a0ccf78409078838d826d816f4a.zip | |
SONAR-4487 the "remember me" cookie must also be flagged HttpOnly
| -rw-r--r-- | sonar-server/src/main/webapp/WEB-INF/app/controllers/sessions_controller.rb | 2 | ||||
| -rw-r--r-- | sonar-server/src/main/webapp/WEB-INF/lib/authenticated_system.rb | 3 |
2 files changed, 3 insertions, 2 deletions
diff --git a/sonar-server/src/main/webapp/WEB-INF/app/controllers/sessions_controller.rb b/sonar-server/src/main/webapp/WEB-INF/app/controllers/sessions_controller.rb index 49979d701cf..36c69d5ed1b 100644 --- a/sonar-server/src/main/webapp/WEB-INF/app/controllers/sessions_controller.rb +++ b/sonar-server/src/main/webapp/WEB-INF/app/controllers/sessions_controller.rb @@ -31,7 +31,7 @@ class SessionsController < ApplicationController if logged_in? if params[:remember_me] == '1' self.current_user.remember_me - cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at } + cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at, :http_only => true } end redirect_back_or_default(home_url) else diff --git a/sonar-server/src/main/webapp/WEB-INF/lib/authenticated_system.rb b/sonar-server/src/main/webapp/WEB-INF/lib/authenticated_system.rb index 140b12ea41a..5f6f661a660 100644 --- a/sonar-server/src/main/webapp/WEB-INF/lib/authenticated_system.rb +++ b/sonar-server/src/main/webapp/WEB-INF/lib/authenticated_system.rb @@ -197,7 +197,8 @@ module AuthenticatedSystem def send_remember_cookie! cookies[:auth_token] = { :value => @current_user.remember_token, - :expires => @current_user.remember_token_expires_at } + :expires => @current_user.remember_token_expires_at, + :http_only => true } end end |