Opened 12 years ago
Closed 12 years ago
#17766 closed Cleanup/optimization (fixed)
Clarify impact of HttpOnly flag for JS access to session cookie
| Reported by: | Preston Holmes | Owned by: | nobody |
|---|---|---|---|
| Component: | Documentation | Version: | dev |
| Severity: | Normal | Keywords: | |
| Cc: | Triage Stage: | Ready for checkin | |
| Has patch: | yes | Needs documentation: | no |
| Needs tests: | no | Patch needs improvement: | no |
| Easy pickings: | no | UI/UX: | no |
Description
https://github.com/django/django/pull/115
This change impacts anyone accessing the session data from Javascript, for example, when relaying the session ID into a querystring in the case of flash uploading tools. I'm not opening a debate on whether this is proper to do or not, just that it will help people understand possible impacts of this change when using other people's code that may do this (as happened to me).
Note:
See TracTickets
for help on using tickets.
For reference, the original ticket that produced the change is #16847.
The location of this paragraph has moved meanwhile, but the patch is still applicable.