fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-05-03 09:14:48 +09:00
Code Issues Projects Releases Packages Wiki Activity

Improve cookie security; Secure flag

Browse source 
SSL 항상 사용 옵션인 경우 쿠키도 이에 맞추어 SSL 인 경우에만 사용되도록 `secure` flag 를 추가합니다.
선택적 SSL 인 경우 SSL 이 적용되지 않은 구간에서도 쿠키를 읽을 수 있어야 하므로, 적용하지 않습니다.
This commit is contained in:
Min-Soo Kim 2018-04-24 19:30:38 +09:00
parent 5ebbbf5b36
commit c1c9a94623
7 changed files with 26 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
common/framework/session.php
View file

@ -295,7 +295,7 @@ class Session
if(!$is_default_domain && !\Context::get('sso_response') && $_COOKIE['sso'] !== md5($current_domain))
{
// Set sso cookie to prevent multiple simultaneous SSO validation requests.
setcookie('sso', md5($current_domain), 0, '/');
setcookie('sso', md5($current_domain), 0, '/', null, Context::checkSslEnforce());
// Redirect to the default site.
$sso_request = Security::encrypt($current_url);

3
common/js/common.js
View file

@ -1055,7 +1055,8 @@ function getOuterHTML(obj) {
function setCookie(name, value, expire, path) {
var s_cookie = name + "=" + escape(value) +
((!expire) ? "" : ("; expires=" + expire.toGMTString())) +
"; path=" + ((!path) ? "/" : path);
"; path=" + ((!path) ? "/" : path) +
((enforce_ssl) ? ";secure" : "");
document.cookie = s_cookie;
}

2
common/tpl/common_layout.html
View file

@ -55,7 +55,7 @@
var current_mid = {json_encode($mid ?: null)};
var http_port = {Context::get("_http_port") ?: 'null'};
var https_port = {Context::get("_https_port") ?: 'null'};
var enforce_ssl = {Context::get('_use_ssl') === 'always' ? 'true' : 'false'};
var enforce_ssl = {Context::checkSslEnforce() ? 'true' : 'false'};
var ssl_actions = {json_encode(array_keys(Context::getSSLActions()))};
var xeVid = null;
</script>