From: Yousong Zhou <yszhou4tech@gmail.com>
Date: Sun, 13 May 2018 09:55:01 +0000 (+0800)
Subject: luci-base: harden cookie sysauth=
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=2f0f456b7160e05352d34db152f3f41a7500b294;p=oweals%2Fluci.git

luci-base: harden cookie sysauth=

A simple scan of the code indicates that currently no code in the repo
is accessing the sysauth= cookie

Closes openwrt/luci#1555

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
---

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index 1984fc4ad..38932afae 100644
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -428,7 +428,9 @@ function dispatch(request)
 				return
 			end
 
-			http.header("Set-Cookie", 'sysauth=%s; path=%s' %{ sid, build_url() })
+			http.header("Set-Cookie", 'sysauth=%s; path=%s; HttpOnly%s' %{
+				sid, build_url(), http.getenv("HTTPS") == "on" and "; secure" or ""
+			})
 			http.redirect(build_url(unpack(ctx.requestpath)))
 		end