Vote #62973
未完了option to set secure flag on session and autologin cookie
ステータス:
New
優先度:
低め
担当者:
-
カテゴリ:
Accounts / authentication_7
対象バージョン:
-
開始日:
2008/04/03
期日:
進捗率:
0%
予定工数:
Redmineorg_URL:
category_id:
7
version_id:
0
issue_org_id:
982
author_id:
722
assigned_to_id:
0
comments:
2
status_id:
1
tracker_id:
2
plus1:
0
affected_version:
closed_on:
affected_version_id:
説明
Is it possible to have a GUI setting to control the secure flag on the session and autologin cookies? I was able to set them by making the changes below:
app/controllers/account_controller.rb
cookies[:autologin] = { :value => token.value, :expires => 1.year.from_now, :secure => true }
config/environment.rb
ActionController::Base.session_options[:session_secure] = true
thanks!
journals
Any plans to implement this ? I think it's needed to avoid HTTP Session hijacking ?
--------------------------------------------------------------------------------
--------------------------------------------------------------------------------
related_issues
relates,Closed,1763,Autologin-cookie should be configurable
いいね!0