luci-base: harden cookie sysauth=
authorYousong Zhou <yszhou4tech@gmail.com>
Sun, 13 May 2018 09:55:01 +0000 (17:55 +0800)
committerYousong Zhou <yszhou4tech@gmail.com>
Sun, 13 May 2018 10:30:47 +0000 (18:30 +0800)
A simple scan of the code indicates that currently no code in the repo
is accessing the sysauth= cookie

Closes openwrt/luci#1555

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
modules/luci-base/luasrc/dispatcher.lua

index 1984fc4ad2c84b1b5de701ddc1e9a078296647b4..38932afae7b48b5b784892824b5aee6b93fd71ce 100644 (file)
@@ -428,7 +428,9 @@ function dispatch(request)
                                return
                        end
 
-                       http.header("Set-Cookie", 'sysauth=%s; path=%s' %{ sid, build_url() })
+                       http.header("Set-Cookie", 'sysauth=%s; path=%s; HttpOnly%s' %{
+                               sid, build_url(), http.getenv("HTTPS") == "on" and "; secure" or ""
+                       })
                        http.redirect(build_url(unpack(ctx.requestpath)))
                end