From 8621b33e1cd7b5ee610327e64f3cca3361cd789a Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 4 May 2020 11:12:26 +1000 Subject: [PATCH] Bug 25360: Use secure flag for CGISESSID cookie when using HTTPS This patch adds the secure flag to the CGISESSID cookie when using HTTPS. This prevents the cookie being used again over a normal HTTP request. --- C4/Auth.pm | 16 ++++++++++++---- C4/InstallAuth.pm | 8 ++++++-- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 6889c2532c..7b8c522edb 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -229,6 +229,7 @@ sub get_template_and_user { -value => '', -expires => '', -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $template->param( @@ -829,6 +830,7 @@ sub checkauth { -value => '', -expires => '', -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $loggedin = 1; } @@ -929,7 +931,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $session->param( 'lasttime', time() ); unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... @@ -958,7 +961,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { @@ -1124,7 +1128,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $info{'wrongip'} = 1; } @@ -1202,7 +1207,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); } @@ -1469,6 +1475,7 @@ sub check_api_auth { -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $session->param( 'lasttime', time() ); my $flags = haspermission( $userid, $flagsrequired ); @@ -1523,6 +1530,7 @@ sub check_api_auth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); if ( $return == 1 ) { my ( diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 987045df50..8d4d95377a 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -266,6 +266,7 @@ sub checkauth { -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $loggedin = 1; $userid = $session->param('cardnumber'); @@ -306,6 +307,7 @@ sub checkauth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); if ( $return == 2 ) { @@ -351,7 +353,8 @@ sub checkauth { -name => 'CGISESSID', -value => '', -HttpOnly => 1, - -expires => '' + -expires => '', + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); } if ($envcookie) { @@ -393,7 +396,8 @@ sub checkauth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, - -expires => '' + -expires => '', + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); print $query->header( -type => 'text/html; charset=utf-8', -- 2.16.4