#31260: Enable cookie security if HTTPS is explicity indicated in settings
-------------------------------------+-------------------------------------
Reporter: adamyala | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: Core | Version: 3.0
(Other) | Keywords: ssl https cookie
Severity: Normal | settings
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
Per this conversation
https://forum.djangoproject.com/t/why-are-cookie-secure-settings-
defaulted-to-false/
on forum.djangoproject.com with Adam Johnson, the goal of this ticket is
to help improve Django's default security.
By default, SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE are set to False.
The purpose of this ticket is to set SESSION_COOKIE_SECURE and
CSRF_COOKIE_SECURE to True if either SECURE_SSL_REDIRECT or
SECURE_HSTS_SECONDS is enabled.
--
Ticket URL: <https://code.djangoproject.com/ticket/31260>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.81c4d0644b4d24596733006b7f03fb96%40djangoproject.com.
