VladPolskiy/postgres-web
1
0
Fork 0
mirror of https://github.com/postgres/pgweb.git synced 2025-08-06 09:57:57 +00:00
Code Issues Packages Projects Releases Wiki Activity

Secure csrf tokens

Browse Source 
Since we have no forms over non-http now, make sure the cookies are
locked
This commit is contained in:
Magnus Hagander
2016-05-20 16:10:42 -04:00
parent 3c089cd09a
commit 319412156e
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pgweb/settings.py
View File

@ -149,6 +149,11 @@ RECAPTCHA_SECRET_KEY=""
###
SESSION_COOKIE_SECURE=True # Allow our session only over https
SESSION_COOKIE_DOMAIN="www.postgresql.org" # Don't allow access by other postgresql.org sites
SESSION_COOKIE_HTTPONLY=True # Access over http only, no js
CSRF_COOKIE_SECURE=SESSION_COOKIE_SECURE
CSRF_COOKIE_DOMAIN=SESSION_COOKIE_DOMAIN
CSRF_COOKIE_HTTPONLY=SESSION_COOKIE_HTTPONLY
SITE_ROOT="http://www.postgresql.org" # Root of working URLs
FTP_PICKLE="/usr/local/pgweb/ftpsite.pickle" # Location of file with current contents from ftp site
STATIC_CHECKOUT="/usr/local/pgweb-static" # Location of a checked out pgweb-static project