Make session cookies more secure.

1. Our session cookies only need to be available to http, so
   mark them appropiately.

2. Send the cookie to the subpath for mediagoblin.

And instantiate a session manager on the app, once.

diff --git a/mediagoblin/app.py b/mediagoblin/app.py
index 2c772fe11e420689e28dda4238bffaed20100ba4..1137c0d72fffd899af0adfe09193123aba034bc0 100644 (file)
--- a/mediagoblin/app.py
+++ b/mediagoblin/app.py
@@ -73,6 +73,9 @@ class MediaGoblinApp(object):
         # Setup other connections / useful objects
         ##########################################
 
+        # Setup Session Manager, not needed in celery
+        self.session_manager = session.SessionManager()
+
         # load all available locales
         setup_locales()
 
@@ -157,7 +160,7 @@ class MediaGoblinApp(object):
 
         ## Attach utilities to the request object
         # Do we really want to load this via middleware?  Maybe?
-        session_manager = session.SessionManager()
+        session_manager = self.session_manager
         request.session = session_manager.load_session_from_cookie(request)
         # Attach self as request.app
         # Also attach a few utilities from request.app for convenience?
@@ -227,7 +230,8 @@ class MediaGoblinApp(object):
             response = render_http_exeption(
                 request, e, e.get_description(environ))
 
-        session_manager.save_session_to_cookie(request.session, response)
+        session_manager.save_session_to_cookie(request.session,
+                                               request, response)
 
         return response(environ, start_response)
 

diff --git a/mediagoblin/tools/session.py b/mediagoblin/tools/session.py
index d452b85136bc9a1bea3183bd3e2487ee07a7d2a8..64220ed94a589f15910d2d6cce9fb30fc08f57eb 100644 (file)
--- a/mediagoblin/tools/session.py
+++ b/mediagoblin/tools/session.py
@@ -58,10 +58,13 @@ class SessionManager(object):
         except itsdangerous.BadData:
             return Session()
 
-    def save_session_to_cookie(self, session, response):
+    def save_session_to_cookie(self, session, request, response):
         if not session.is_updated():
             return
         elif not session:
-            response.delete_cookie(self.cookie_name)
+            response.delete_cookie(self.cookie_name,
+                path=request.environ['SCRIPT_NAME'])
         else:
-            response.set_cookie(self.cookie_name, self.signer.dumps(session))
+            response.set_cookie(self.cookie_name, self.signer.dumps(session),
+                path=request.environ['SCRIPT_NAME'],
+                httponly=True)