From 2f0f456b7160e05352d34db152f3f41a7500b294 Mon Sep 17 00:00:00 2001 From: Yousong Zhou Date: Sun, 13 May 2018 17:55:01 +0800 Subject: [PATCH 1/1] luci-base: harden cookie sysauth= A simple scan of the code indicates that currently no code in the repo is accessing the sysauth= cookie Closes openwrt/luci#1555 Signed-off-by: Florian Eckert Signed-off-by: Yousong Zhou --- modules/luci-base/luasrc/dispatcher.lua | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua index 1984fc4ad..38932afae 100644 --- a/modules/luci-base/luasrc/dispatcher.lua +++ b/modules/luci-base/luasrc/dispatcher.lua @@ -428,7 +428,9 @@ function dispatch(request) return end - http.header("Set-Cookie", 'sysauth=%s; path=%s' %{ sid, build_url() }) + http.header("Set-Cookie", 'sysauth=%s; path=%s; HttpOnly%s' %{ + sid, build_url(), http.getenv("HTTPS") == "on" and "; secure" or "" + }) http.redirect(build_url(unpack(ctx.requestpath))) end -- 2.11.0