Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enhance Clef state and session cookie flags #254

Merged
merged 3 commits into from Jun 23, 2016
Merged

Enhance Clef state and session cookie flags #254

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
11abccb
Set httponly flag on wordpress_clef_session cookie; also set secure f…
Jun 23, 2016
e6c5fb9
Refactor httponly and secure flags for Clef state and session cookies
Jun 23, 2016
6bddc60
Refactor is_tls()
Jun 23, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
12 changes: 11 additions & 1 deletion includes/class.clef-utils.php
View file
Open in desktop
Expand Up @@ -250,7 +250,7 @@ public static function initialize_state($override = false) {
if (!$override && isset($_COOKIE[self::$cookie_name]) && $_COOKIE[self::$cookie_name]) return;

$state = wp_generate_password(24, false);
@setcookie(self::$cookie_name, $state, (time() + 60 * 60 * 24), '/', '', is_ssl(), true);
@setcookie(self::$cookie_name, $state, (time() + 60 * 60 * 24), '/', '', ClefUtils::is_tls(), true);
$_COOKIE[self::$cookie_name] = $state;

return $state;
Expand Down Expand Up @@ -306,5 +306,15 @@ public static function get_logout_hook_url() {

return $logout_hook_url;
}

public static function is_tls() {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you refactor this to just return the conditional value:

return is_ssl() || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https');

if ( is_ssl() ) {
return true;
} elseif ( isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https' ) {
return true;
} else {
return false;
}
}
}
?>
2 changes: 1 addition & 1 deletion includes/lib/wp-session/class-wp-session.php
View file
Open in desktop
Expand Up @@ -127,7 +127,7 @@ protected function set_expiration() {
* Set the session cookie
*/
protected function set_cookie() {
setcookie( $this->cookie_name, $this->session_id . '||' . $this->expires . '||' . $this->exp_variant , (int) $this->expires, COOKIEPATH, COOKIE_DOMAIN );
setcookie( $this->cookie_name, $this->session_id . '||' . $this->expires . '||' . $this->exp_variant , (int) $this->expires, COOKIEPATH, COOKIE_DOMAIN, ClefUtils::is_tls(), true );
}

/**
Expand Down