Download as
Browse Code »

Commit ba7c1764be87f272759471bde01b92dcc147e952

Authored by Sytse Sijbrandij
1 parent f81532b5
Exists in master and in 4 other branches 6-8-stable, 7-0-stable, 7-0-stable-spb, spb-stable

The cookie store is vulnerable to session replay attacks.

Showing 2 changed files with 8 additions and 9 deletions   Show diff stats
@@ -14,6 +14,7 @@ v 6.2.0 @@ -14,6 +14,7 @@ v 6.2.0
14 - Extended User API to expose admin and can_create_group for user creation/updating (Boyan Tabakov) 14 - Extended User API to expose admin and can_create_group for user creation/updating (Boyan Tabakov)
15 - API: Remove group 15 - API: Remove group
16 - Avatar upload on profile page with a maximum of 200KB (Steven Thonus) 16 - Avatar upload on profile page with a maximum of 200KB (Steven Thonus)
  17 + - Store the sessions in Redis instead of the cookie store
17 18
18 v 6.1.0 19 v 6.1.0
19 - Project specific IDs for issues, mr, milestones 20 - Project specific IDs for issues, mr, milestones
config/initializers/session_store.rb
  Diff comments   View file @ba7c176
1 # Be sure to restart your server when you modify this file. 1 # Be sure to restart your server when you modify this file.
2 2
3 -Gitlab::Application.config.session_store :cookie_store, key: '_gitlab_session',  
4 - secure: Gitlab::Application.config.force_ssl,  
5 - httponly: true,  
6 - path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root  
7 -  
8 -# Use the database for sessions instead of the cookie-based default,  
9 -# which shouldn't be used to store highly confidential information  
10 -# (create the session table with "rails generate session_migration")  
11 -# Gitlab::Application.config.session_store :active_record_store 3 +Gitlab::Application.config.session_store(
  4 + :redis_store, # Using the cookie_store would enable session replay attacks.
  5 + key: '_gitlab_session',
  6 + secure: Gitlab::Application.config.force_ssl,
  7 + httponly: true,
  8 + path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root
  9 +)