From febb7f9987c06b24e4779a6da089899badf46e92 Mon Sep 17 00:00:00 2001 From: David Cook Date: Mon, 4 May 2020 11:12:26 +1000 Subject: [PATCH] Bug 25360: Use secure flag for CGISESSID cookie when using HTTPS This patch adds the secure flag to the CGISESSID cookie when using HTTPS. This prevents the cookie being used again over a normal HTTP request. --- C4/Auth.pm | 16 ++++++++++++---- C4/InstallAuth.pm | 8 ++++++-- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/C4/Auth.pm b/C4/Auth.pm index 295eb27ece..95c03e4312 100644 --- a/C4/Auth.pm +++ b/C4/Auth.pm @@ -244,6 +244,7 @@ sub get_template_and_user { -value => '', -expires => '', -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $template->param( @@ -862,6 +863,7 @@ sub checkauth { -value => '', -expires => '', -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $loggedin = 1; } @@ -993,7 +995,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $session->param( 'lasttime', time() ); unless ( $sessiontype && $sessiontype eq 'anon' ) { #if this is an anonymous session, we want to update the session, but not behave as if they are logged in... @@ -1022,7 +1025,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => $session->id, - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); my $pki_field = C4::Context->preference('AllowPKIAuth'); if ( !defined($pki_field) ) { @@ -1215,7 +1219,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $info{'wrongip'} = 1; } @@ -1304,7 +1309,8 @@ sub checkauth { $cookie = $query->cookie( -name => 'CGISESSID', -value => '', - -HttpOnly => 1 + -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); } @@ -1720,6 +1726,7 @@ sub check_api_auth { -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $session->param( 'lasttime', time() ); my $flags = haspermission( $userid, $flagsrequired ); @@ -1774,6 +1781,7 @@ sub check_api_auth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); if ( $return == 1 ) { my ( diff --git a/C4/InstallAuth.pm b/C4/InstallAuth.pm index 67319b3db6..223ed2cb32 100644 --- a/C4/InstallAuth.pm +++ b/C4/InstallAuth.pm @@ -267,6 +267,7 @@ sub checkauth { -name => 'CGISESSID', -value => $session->id, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); $loggedin = 1; $userid = $session->param('cardnumber'); @@ -307,6 +308,7 @@ sub checkauth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); if ( $return == 2 ) { @@ -352,7 +354,8 @@ sub checkauth { -name => 'CGISESSID', -value => '', -HttpOnly => 1, - -expires => '' + -expires => '', + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); } if ($envcookie) { @@ -394,7 +397,8 @@ sub checkauth { -name => 'CGISESSID', -value => $sessionID, -HttpOnly => 1, - -expires => '' + -expires => '', + -secure => ( $ENV{HTTPS} ? 1 : 0 ), ); print $query->header( -type => 'text/html; charset=utf-8', -- 2.16.4