Feature #21697

Set secure flag of the session cookie depending on original request

Added by Sergey B over 3 years ago. Updated over 1 year ago.

Status:ReopenedStart date:
Priority:NormalDue date:
Assignee:-% Done:

0%

Category:Security
Target version:-
Resolution:

Description

The default configuration of redmine sends session cookie open for any connection type. This allows an attacker to steal the session cookie and access one's redmine session.

It is possible to secure the cookie by changing the option in application.rb file.

config.session_store :cookie_store, :key => '_redmine_session', :secure => true

But this will prevent users from accessing system via plain HTTP protocol in local network.

Let Redmine set secure cookie flag depending on request scheme and X-Forwarded-Proto HTTP-header.

Related issues

Related to Redmine - Feature #20935: Set autologin cookie as secure by default when using https Closed

History

#1 Updated by Go MAEDA over 3 years ago

  • Status changed from New to Closed
  • Resolution set to Duplicate

Fixed by #20935. Please try Redmine 3.2.0.

#2 Updated by Go MAEDA over 3 years ago

  • Duplicates Feature #20935: Set autologin cookie as secure by default when using https added

#3 Updated by Sergey B over 3 years ago

The issue #20935 doesn't seem to fix _redmine_session cookie.

#4 Updated by Go MAEDA over 3 years ago

  • Status changed from Closed to Reopened

#5 Updated by Go MAEDA over 3 years ago

  • Duplicates deleted (Feature #20935: Set autologin cookie as secure by default when using https)

#6 Updated by Go MAEDA over 3 years ago

  • Related to Feature #20935: Set autologin cookie as secure by default when using https added

#7 Updated by Go MAEDA over 3 years ago

  • Resolution deleted (Duplicate)

#9 Updated by Mahesha Matharage over 3 years ago

This issue cannot simulate in the Dev environment.

#10 Updated by Sergey B over 3 years ago

Steps to simulate task

  1. Set up redmine on host A, HTTP-port 80
  2. Set up reverse proxy on host B, SSL-port 443
  3. Get Redmine page via address http://A/redmine
  4. Get Redemin page via address https://B/redmine

Desired behaviour

  1. Browser receives header Set-Cookie: _redmine_session=...--...; path=/redmine/ from domain A
  2. Browser receives header Set-Cookie: _redmine_session=...--...; path=/redmine/; secure; HttpOnly from domain B

#11 Updated by Toshi MARUYAMA over 1 year ago

  • Description updated (diff)

Also available in: Atom PDF