altf4arnold/datatracker
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

Added some cookie settings and changed others, in order to support login and operation from a meetecho iframe.

Browse source 
- Legacy-Id: 18139
This commit is contained in:
Henrik Levkowetz 2020-07-08 14:39:38 +00:00
parent b8b69b1698
commit d81a0e455b
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
ietf/settings.py
View file

@ -62,11 +62,6 @@ PASSWORD_HASHERS = [
ALLOWED_HOSTS = [".ietf.org", ".ietf.org.", "209.208.19.216", "4.31.198.44", "127.0.0.1", "localhost:8000", ] ALLOWED_HOSTS = [".ietf.org", ".ietf.org.", "209.208.19.216", "4.31.198.44", "127.0.0.1", "localhost:8000", ]
X_FRAME_OPTIONS = 'ALLOW-FROM meetecho.com *.meetecho.com *.ietf.org'
CSRF_TRUSTED_ORIGINS = ['meetecho.com', '*.meetecho.com', '*.ietf.org', ]
CSRF_COOKIE_SAMESITE = None
# Server name of the tools server # Server name of the tools server
TOOLS_SERVER = 'tools.' + IETF_DOMAIN TOOLS_SERVER = 'tools.' + IETF_DOMAIN
TOOLS_SERVER_URL = 'https://' + TOOLS_SERVER TOOLS_SERVER_URL = 'https://' + TOOLS_SERVER
@ -331,8 +326,16 @@ UTILS_LOGGER_LEVELS: Dict[str, str] = {
# ------------------------------------------------------------------------ # ------------------------------------------------------------------------
X_FRAME_OPTIONS = 'ALLOW-FROM meetecho.com *.meetecho.com *.ietf.org'
CSRF_TRUSTED_ORIGINS = ['meetecho.com', '*.meetecho.com', '*.ietf.org', ]
CSRF_COOKIE_SAMESITE = 'None'
CSRF_COOKIE_SECURE = True
# SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 2 # Age of cookie, in seconds: 2 weeks (django default) # SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 2 # Age of cookie, in seconds: 2 weeks (django default)
SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 4 # Age of cookie, in seconds: 4 weeks SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 4 # Age of cookie, in seconds: 4 weeks
SESSION_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SECURE = True
SESSION_EXPIRE_AT_BROWSER_CLOSE = False SESSION_EXPIRE_AT_BROWSER_CLOSE = False
# We want to use the JSON serialisation, as it's safer -- but there is /secr/ # We want to use the JSON serialisation, as it's safer -- but there is /secr/
# code which stashes objects in the session that can't be JSON serialized. # code which stashes objects in the session that can't be JSON serialized.
@ -1113,6 +1116,7 @@ CHECKS_LIBRARY_PATCHES_TO_APPLY = [
'patch/fix-jwkest-jwt-logging.patch', 'patch/fix-jwkest-jwt-logging.patch',
'patch/fix-oic-logging.patch', 'patch/fix-oic-logging.patch',
'patch/fix-django-password-strength-kwargs.patch', 'patch/fix-django-password-strength-kwargs.patch',
'patch/add-django-http-cookie-value-none.patch',
] ]
if DEBUG: if DEBUG:
try: try:
@ -1212,3 +1216,6 @@ if SERVER_MODE != 'production':
except ImportError: except ImportError:
pass pass
# Cannot have this set to True if we're using http: from the dev-server:
CSRF_COOKIE_SECURE = False
SESSION_COOKIE_SECURE = False