Ticket #3304: django_httponly_patch.diff

django/http/__init__.py

@@ -1 +1 @@
 import os
 import re
-from Cookie import SimpleCookie, CookieError
+import Cookie
+if Cookie.Morsel._reserved.has_key('httponly'):
+    SimpleCookie = Cookie.SimpleCookie
+    CookieError = Cookie.CookieError
+else:
+    class Morsel(Cookie.Morsel):
+        def __setitem__(self, K, V):
+            K = K.lower()
+            if K == "httponly":
+                if V:
+                    self.__dict__.__setitem__(K, "")
+            else:
+                super(Morsel, self).__setitem__(K, V)
+
+        def OutputString(self, attrs=None):
+            output = super(Morsel, self).OutputString(attrs)
+            if "httponly" in self.__dict__:
+                output += "; httpOnly"
+            return output
+
+    class SimpleCookie(Cookie.SimpleCookie):
+        def __set(self, key, real_value, coded_value):
+            M = self.get(key, Morsel())
+            M.set(key, real_value, coded_value)
+            dict.__setitem__(self, key, M)
+
+        def __setitem__(self, key, value):
+            rval, cval = self.value_encode(value)
+            self.__set(key, rval, cval)
+
 from pprint import pformat
 from urllib import urlencode
 from urlparse import urljoin
@@ -342 +371 @@
         return self._headers.get(header.lower(), (None, alternate))[1]
 
     def set_cookie(self, key, value='', max_age=None, expires=None, path='/',
-                   domain=None, secure=False):
+                   domain=None, secure=False, httponly=None):
         self.cookies[key] = value
         if max_age is not None:
             self.cookies[key]['max-age'] = max_age
@@ -354 +383 @@
             self.cookies[key]['domain'] = domain
         if secure:
             self.cookies[key]['secure'] = True
+        if httponly:
+            self.cookies[key]['httponly'] = True
 
     def delete_cookie(self, key, path='/', domain=None):
         self.set_cookie(key, max_age=0, path=path, domain=domain,

django/conf/global_settings.py

@@ -316 +316 @@
 SESSION_COOKIE_PATH = '/'                               # The path of the session cookie.
 SESSION_SAVE_EVERY_REQUEST = False                      # Whether to save the session data on every request.
 SESSION_EXPIRE_AT_BROWSER_CLOSE = False                 # Whether a user's session cookie expires when the Web browser is closed.
+SESSION_HTTP_ONLY = False                 # Whether to use the non-RFC standard httpOnly flag (IE, FF3+, others)
 SESSION_ENGINE = 'django.contrib.sessions.backends.db'  # The module to store session data
 SESSION_FILE_PATH = None                                # Directory to store session files if using the file session module. If None, the backend will use a sensible default.
 

django/contrib/sessions/middleware.py

@@ -38 +38 @@
                         request.session.session_key, max_age=max_age,
                         expires=expires, domain=settings.SESSION_COOKIE_DOMAIN,
                         path=settings.SESSION_COOKIE_PATH,
-                        secure=settings.SESSION_COOKIE_SECURE or None)
+                        secure=settings.SESSION_COOKIE_SECURE or None,
+                        httponly=settings.SESSION_HTTP_ONLY or None)
         return response

docs/topics/http/sessions.txt

@@ -484 +484 @@
 Whether to expire the session when the user closes his or her browser. See
 "Browser-length sessions vs. persistent sessions" above.
 
+SESSION_HTTP_ONLY
+-----------------
+
+Default: ``False``
+
+Whether to use HTTPOnly flag on cookies. If this is set to ``True``, javascript will not to be able to access the cookie.
+HTTPOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HTTPOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).
+
 SESSION_SAVE_EVERY_REQUEST
 --------------------------
 

docs/ref/settings.txt

@@ -941 +941 @@
 Whether to expire the session when the user closes his or her browser.
 See the :ref:`topics-http-sessions`.
 
+.. setting:: SESSION_HTTP_ONLY
+
+SESSION_HTTP_ONLY
+-----------------
+
+Default: ``False``
+
+Whether to use HTTPOnly flag on cookies. If this is set to ``True``, javascript will not to be able to access the cookie.
+HTTPOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HTTPOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).
+
+See the :ref:`topics-http-sessions`.
+See http://www.owasp.org/index.php/HTTPOnly
+
 .. setting:: SESSION_FILE_PATH
 
 SESSION_FILE_PATH