r5471 - in trunk: cumin/bin cumin/python/cumin wooly/python/wooly
tmckay at fedoraproject.org
tmckay at fedoraproject.org
Wed Sep 26 11:43:20 UTC 2012
Author: tmckay
Date: 2012-09-26 11:43:19 +0000 (Wed, 26 Sep 2012)
New Revision: 5471
Modified:
trunk/cumin/bin/cumin-web
trunk/cumin/python/cumin/config.py
trunk/cumin/python/cumin/main.py
trunk/cumin/python/cumin/server.py
trunk/wooly/python/wooly/__init__.py
trunk/wooly/python/wooly/server.py
Log:
Use secure cookies when SSL is enabled
BZ831203
Modified: trunk/cumin/bin/cumin-web
===================================================================
--- trunk/cumin/bin/cumin-web 2012-09-18 19:52:58 UTC (rev 5470)
+++ trunk/cumin/bin/cumin-web 2012-09-26 11:43:19 UTC (rev 5471)
@@ -202,6 +202,7 @@
cumin = Cumin(config.get_home(), broker_uris, opts.database,
opts.host, opts.port,
opts.server_cert, opts.server_key,
+ values.force_secure_cookies,
values.persona, authmech)
# If the mech_list was set explicitly, honor it.
Modified: trunk/cumin/python/cumin/config.py
===================================================================
--- trunk/cumin/python/cumin/config.py 2012-09-18 19:52:58 UTC (rev 5470)
+++ trunk/cumin/python/cumin/config.py 2012-09-26 11:43:19 UTC (rev 5471)
@@ -178,6 +178,9 @@
param = ConfigParameter(self, "authorize", bool)
param.default = False
+ param = ConfigParameter(self, "force-secure-cookies", bool)
+ param.default = False
+
# param = ConfigParameter(self, "auth-proxy", bool)
# param.default = False
Modified: trunk/cumin/python/cumin/main.py
===================================================================
--- trunk/cumin/python/cumin/main.py 2012-09-18 19:52:58 UTC (rev 5470)
+++ trunk/cumin/python/cumin/main.py 2012-09-26 11:43:19 UTC (rev 5471)
@@ -35,12 +35,16 @@
def __init__(self, home, broker_uris, database_dsn,
host="localhost", port=45672,
server_cert="", server_key="",
+ force_secure_cookies=False,
persona="default",
authmech=[]):
super(Cumin, self).__init__()
self.home = home
self.authmech = authmech
+ # For use behind a proxy, when Cumin does not
+ # have ssl enabled but the proxy does.
+ self.force_secure_cookies = force_secure_cookies
# Settings for LDAP authentication
self.ldap_timeout = None
Modified: trunk/cumin/python/cumin/server.py
===================================================================
--- trunk/cumin/python/cumin/server.py 2012-09-18 19:52:58 UTC (rev 5470)
+++ trunk/cumin/python/cumin/server.py 2012-09-26 11:43:19 UTC (rev 5471)
@@ -8,6 +8,12 @@
# Elements of WebServer will look for the cert/key fields
self.server_cert = server_cert
self.server_key = server_key
+
+ # If ssl is enabled successfully, this flag will be set
+ # to true.
+ self.ssl_enabled = False
+ self.force_secure_cookies = app.force_secure_cookies
+
super(CuminServer, self).__init__(app, host, port)
def authorized(self, session):
Modified: trunk/wooly/python/wooly/__init__.py
===================================================================
--- trunk/wooly/python/wooly/__init__.py 2012-09-18 19:52:58 UTC (rev 5470)
+++ trunk/wooly/python/wooly/__init__.py 2012-09-26 11:43:19 UTC (rev 5471)
@@ -845,7 +845,7 @@
if param:
param.add(self, param.unmarshal(value), key)
- def marshal_cookies(self):
+ def marshal_cookies(self, secure_cookies):
"""
Produce a list of strings representing cookies newly set on
this session.
@@ -867,6 +867,9 @@
when = expires.strftime(self.http_date_gmt)
crumbs.append("expires=%s" % when)
+ if secure_cookies:
+ crumbs.append("secure")
+
headers.append("; ".join(crumbs))
return headers
Modified: trunk/wooly/python/wooly/server.py
===================================================================
--- trunk/wooly/python/wooly/server.py 2012-09-18 19:52:58 UTC (rev 5470)
+++ trunk/wooly/python/wooly/server.py 2012-09-26 11:43:19 UTC (rev 5471)
@@ -161,7 +161,8 @@
if cache:
headers.append(("Cache-Control", cache))
- for header in session.marshal_cookies():
+ secure_cookies = self.ssl_enabled or self.force_secure_cookies
+ for header in session.marshal_cookies(secure_cookies):
headers.append(("Set-Cookie", header))
return status, headers, content
@@ -249,6 +250,7 @@
log.warn("Webserver: SSL was requested, but imports failed "
"for SSL implementations. Running with http only.")
else:
+ self.server.ssl_enabled = True
self.wsgi_server.ssl_adapter = ssl_adapter
self.wsgi_server.environ["wsgi.version"] = (1, 1)
More information about the cumin-developers
mailing list