Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Set a wildcard subdomain for the session and csrf cookie domains on staging 

(imported from commit fda2d99d9e9a07951d11fcd9fc61cf229988f471)
This commit is contained in:
Zev Benjamin 2013-01-17 20:42:54 -05:00
parent b7482bc619
commit f6547dedb1
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
humbug/settings.py
View File

@ -117,6 +117,11 @@ if DEPLOYED:
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
# For get_updates host sharding
if STAGING_DEPLOYED:
SESSION_COOKIE_DOMAIN = '.' + platform.node()
CSRF_COOKIE_DOMAIN = '.' + platform.node()
# Prevent Javascript from reading the CSRF token from cookies. Our code gets
# the token from the DOM, which means malicious code could too. But hiding the
# cookie will slow down some attackers.