From 229e202a729617e4164c95a27fa3e3bcfd496417 Mon Sep 17 00:00:00 2001 From: Raphael Date: Thu, 4 Nov 2010 15:17:17 -0700 Subject: [PATCH] Take httponly off of session cookies so that the websocket works in firefox 3.x. XSS attacks would now be easier to exploit if found. A possible replacement for opening this security hole is to set a new cookie value for Firefox users that stores a randomly generated key which would give a websocket with that key access. --- config/initializers/session_store.rb | 2 +- script/websocket_server.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb index 29a6621f3..ffbf35d2f 100644 --- a/config/initializers/session_store.rb +++ b/config/initializers/session_store.rb @@ -4,7 +4,7 @@ # Be sure to restart your server when you modify this file. -Rails.application.config.session_store :cookie_store, :key => '_diaspora_session' +Rails.application.config.session_store :cookie_store, :key => '_diaspora_session', :httponly => false # Use the database for sessions instead of the cookie-based default, # which shouldn't be used to store highly confidential information diff --git a/script/websocket_server.rb b/script/websocket_server.rb index 3cde39634..2b308832b 100644 --- a/script/websocket_server.rb +++ b/script/websocket_server.rb @@ -25,7 +25,7 @@ def write_pidfile end def debug_pp thing - pp thing if APP_CONFIG[:socket_debug] || ENV[:SOCKET_DEBUG] + pp thing if APP_CONFIG[:socket_debug] || ENV['SOCKET_DEBUG'] end CHANNEL = Magent::GenericChannel.new('websocket')