Ticket #3304: httponly.patch

conf/global_settings.py

@@ -264 +264 @@
-SESSION_COOKIE_SECURE = False             # Whether the session cookie should be secure (https:// only).
-SESSION_SAVE_EVERY_REQUEST = False        # Whether to save the session data on every request.
-SESSION_EXPIRE_AT_BROWSER_CLOSE = False   # Whether sessions expire when a user closes his browser.
+SESSION_HTTP_ONLY = False                 # Whether to use the non-RFC standard httpOnly flag (IE, FF3+, others)
-
-#########
-# CACHE #

contrib/sessions/middleware.py

@@ -94 +94 @@
-                    datetime.datetime.now() + datetime.timedelta(seconds=settings.SESSION_COOKIE_AGE))
-                response.set_cookie(settings.SESSION_COOKIE_NAME, session_key,
-                    max_age=max_age, expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
-
+
+
-        return response

http/__init__.py

@@ -1 +1 @@
-import os
-
+, Morsel
-from pprint import pformat
-from urllib import urlencode, quote
-from django.utils.datastructures import MultiValueDict
@@ -153 +153 @@
-        cookiedict[key] = c.get(key).value
-    return cookiedict
-
+class MorselWrapper(Morsel):
+    " Identical to Cookie.Moresel but intercepts httponly-aware "
+    def __setitem__(self, K, V):
+        K = K.lower()
+        if K == "httponly":
+            if V:
+                self.__dict__.__setitem__(K, "")
+        else:
+            super(MorselWrapper, self).__setitem__(K, V)
+
+    def OutputString(self, attrs=None):
+        output = super(MorselWrapper, self).OutputString(attrs)
+        if "httponly" in self.__dict__:
+            output += "; httpOnly"
+        return output
+
+class SimpleCookieWrapper(SimpleCookie):
+    " Identical to Cookie.SimpleCookie but intercepts cookie creation to use MorselWrapper "
+    def __set(self, key, real_value, coded_value):
+        M = self.get(key, MorselWrapper())
+        M.set(key, real_value, coded_value)
+        dict.__setitem__(self, key, M)
+
+    def __setitem__(self, key, value):
+        rval, cval = self.value_encode(value)
+        self.__set(key, rval, cval)
+
-class HttpResponse(object):
-    "A basic HTTP response, with content and dictionary-accessed headers"
-    def __init__(self, content='', mimetype=None):
@@ -167 +194 @@
-            self._container = [content]
-            self._is_string = True
-        self.headers = {'Content-Type': mimetype}
-
+Wrapper
-        self.status_code = 200
-
-    def __str__(self):
@@ -196 +223 @@
-                return True
-        return False
-
-
+, httponly=None
-        self.cookies[key] = value
-
+, 'httponly'
-            val = locals()[var]
-            if val is not None:
-                self.cookies[key][var.replace('_', '-')] = val