Fix for CVE-2015-1848, CVE-2015-3983 (sessions not signed)

ClusterLabs · May 19, 2015 · 8982045 · 8982045
1 parent c843c42
commit 8982045
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/pcsd/pcsd.rb b/pcsd/pcsd.rb
@@ -31,7 +31,9 @@
 
 use Rack::Session::Cookie,
   :expire_after => 60 * 60,
-  :secret => secret
+  :secret => secret,
+  :secure => true, # only send over HTTPS
+  :httponly => true # don't provide to javascript
 
 #use Rack::SSL
 
@@ -45,8 +47,6 @@
 also_reload 'auth.rb'
 also_reload 'wizard.rb'
 
-enable :sessions
-
 before do
   $session = session
   $cookies = cookies