Opened 13 years ago

Closed 13 years ago

#17766 closed Cleanup/optimization (fixed)

Clarify impact of HttpOnly flag for JS access to session cookie

Reported by: Preston Holmes Owned by: nobody
Component: Documentation Version: dev
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

https://github.com/django/django/pull/115

This change impacts anyone accessing the session data from Javascript, for example, when relaying the session ID into a querystring in the case of flash uploading tools. I'm not opening a debate on whether this is proper to do or not, just that it will help people understand possible impacts of this change when using other people's code that may do this (as happened to me).

Change History (2)

comment:1 by Claude Paroz, 13 years ago

Triage Stage: UnreviewedReady for checkin

For reference, the original ticket that produced the change is #16847.

The location of this paragraph has moved meanwhile, but the patch is still applicable.

comment:2 by Paul McMillan, 13 years ago

Resolution: fixed
Status: newclosed

In [17618]:

Fixed #17766. Clarified HttpOnly flag on session cookie.

Thanks ptone for the patch!

Note: See TracTickets for help on using tickets.
Back to Top