Changeset 3570

Timestamp:

08/12/06 01:02:28 (2 years ago)

Author:

adrian

Message:

Fixed #2523 -- Added SESSION_COOKIE_SECURE setting. Thanks, mir@noris.de

Files:

• django/trunk/django/conf/global_settings.py (modified) (1 diff)
• django/trunk/django/contrib/sessions/middleware.py (modified) (1 diff)
• django/trunk/docs/sessions.txt (modified) (1 diff)
• django/trunk/docs/settings.txt (modified) (1 diff)

django/trunk/django/conf/global_settings.py

@@ -253 +253 @@
-SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 2 # Age of cookie, in seconds (default: 2 weeks).
-SESSION_COOKIE_DOMAIN = None              # A string like ".lawrence.com", or None for standard domain cookie.
+SESSION_COOKIE_SECURE = False             # Whether the session cookie should be secure (https:// only).
-SESSION_SAVE_EVERY_REQUEST = False        # Whether to save the session data on every request.
-SESSION_EXPIRE_AT_BROWSER_CLOSE = False   # Whether sessions expire when a user closes his browser.

django/trunk/django/contrib/sessions/middleware.py

@@ -89 +89 @@
-                    datetime.datetime.now() + datetime.timedelta(seconds=settings.SESSION_COOKIE_AGE))
-                response.set_cookie(settings.SESSION_COOKIE_NAME, session_key,
-
+
+
-        return response

django/trunk/docs/sessions.txt

@@ -246 +246 @@
-The name of the cookie to use for sessions. This can be whatever you want.
-
+SESSION_COOKIE_SECURE
+---------------------
+
+**New in Django development version**
+
+Default: ``False``
+
+Whether to use a secure cookie for the session cookie. If this is set to
+``True``, the cookie will be marked as "secure," which means browsers may
+ensure that the cookie is only sent under an HTTPS connection.
+
-SESSION_EXPIRE_AT_BROWSER_CLOSE
--------------------------------

django/trunk/docs/settings.txt

@@ -648 +648 @@
-See the `session docs`_.
-
+SESSION_COOKIE_SECURE
+---------------------
+
+**New in Django development version**
+
+Default: ``False``
+
+Whether to use a secure cookie for the session cookie. If this is set to
+``True``, the cookie will be marked as "secure," which means browsers may
+ensure that the cookie is only sent under an HTTPS connection.
+See the `session docs`_.
+
-SESSION_EXPIRE_AT_BROWSER_CLOSE
--------------------------------