Skip to content

Commit

Permalink
Add cookie information (5) sp
Browse files Browse the repository at this point in the history
  • Loading branch information
barryo committed Jun 29, 2023
1 parent e6deadd commit be3d317
Show file tree
Hide file tree
Showing 5 changed files with 27 additions and 21 deletions.
6 changes: 6 additions & 0 deletions .vscode/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
{
"cSpell.words": [
"inex",
"Laravel"
]
}
16 changes: 8 additions & 8 deletions docs/usage/cookies.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
# Cookies and Privacy

IXP Manager is open-source and free software. Any individual or organisation who installs IXP Manager and/or makes it available for use must ensure that they are complying with all appropriuate data protection legislation in their jurisdiction as the data controller.
IXP Manager is open-source and free software. Any individual or organisation who installs IXP Manager and/or makes it available for use must ensure that they are complying with all appropriate data protection legislation in their jurisdiction as the data controller.

This page details what the developers consider appropropriate information to the best of the knowledge for helping such organisations in with such compliance.
This page details what the developers consider appropriate information to the best of the knowledge for helping such organisations in with such compliance.


## Cookies
Expand All @@ -12,16 +12,16 @@ Cookies are small text files that websites place on your device as you are brows

**IXP Manager** uses a PHP web application framework called Laravel and it generates two encrypted cookies which are required to use the application:

| Cookie Name | Purpose and Desciption | Classification | Lifetime |
| Cookie Name | Purpose and Description | Classification | Lifetime |
|-------|--------|------|------|
| `laravel_session` | Session management - since HTTP driven applications are stateless, sessions provide a way to store information about the user across multiple requests. These cookies are encrypted by the server and the client browser only receives and stores the encrypted version. | Strictly Necessary | 120 minutes |
| `XSRF-TOKEN` | Cross-site request forgeries are a type of malicious exploit whereby unauthorized commands are performed on behalf of an authenticated user. Laravel stores the current CSRF token in an encrypted `XSRF-TOKEN` cookie that is included with each response generated by the framework. | Strictly Necessary | 120 minutes |

A third cookie is generated if a user optionally invokes the *Remember Me* functionality during login / authentication:

| Cookie Name | Purpose and Desciption | Classification | Lifetime |
| Cookie Name | Purpose and Description | Classification | Lifetime |
|-------|--------|------|------|
| `remember_web_xxx` | Session management cookie to facilitate longer sessions and multiple session functionality. These cookies are encypted by the server and only the encrypted version exists on the client side browser. These only contain a session ID. The server records the user's IP address and a browser identifier (e.g. *Macintosh 10 / Firefox 109.0*) so that users can identify and optionally delete long-lived sessions in the user interface. | Strictly Necessary and Opt In | 30 days |
| `remember_web_xxx` | Session management cookie to facilitate longer sessions and multiple session functionality. These cookies are encrypted by the server and only the encrypted version exists on the client side browser. These only contain a session ID. The server records the user's IP address and a browser identifier (e.g. *Macintosh 10 / Firefox 109.0*) so that users can identify and optionally delete long-lived sessions in the user interface. | Strictly Necessary and Opt In | 30 days |

IXP Manager does not generate any other cookies.

Expand All @@ -34,7 +34,7 @@ IXP Manager uses only first-party strictly necessary cookies. IXP Manager does n



### Cookies and EU ePrivary and GDPR Law
### Cookies and EU ePrivacy and GDPR Law

As **IXP Manager** generates only *Strictly Necessary* cookies, it does not need to receive users' consent for the use of these cookies.

Expand All @@ -45,9 +45,9 @@ The following table is a summary of personal data collected by IXP Manager and f

| Data Collected | Purpose / Activity |
|---------|---------|
| Contact details including name, position and role, phone number, email address, etc. These are stored on a per mmeber basis and customer admins can also add, edit and remove these. | To manage and facilitate customers / members of an exchange; usually in the performance of a contract. |
| Contact details including name, position and role, phone number, email address, etc. These are stored on a per member basis and customer admins can also add, edit and remove these. | To manage and facilitate customers / members of an exchange; usually in the performance of a contract. |
| Usernames and passwords | To provide members / customers with access to secure areas of IXP Manager; usually in the performance of a contract. |
| Login history (IP addreess, date and time) | To provide an auditable record of when users logged into IXP Manager; usually in compliance with ISMS policies. |
| Login history (IP address, date and time) | To provide an auditable record of when users logged into IXP Manager; usually in compliance with ISMS policies. |
| Login IP address and browser identifier | To enable users to identify and optionally delete long-lived sessions that they opt into. |
| Generic note fields | Many records on IXP Manager allow admins to enter free text notes. You should ensure you have appropriate policies for this. Their use would be to manage and facilitate customers / members of an exchange; usually in the performance of a contract. |
| Document store - file uploads | Admins can upload files to a central store or to a per customer / member store. You should ensure you have appropriate policies for this. The suggested use case is copies of contracts; service order forms; etc. |
Expand Down
2 changes: 1 addition & 1 deletion site/search/search_index.json

Large diffs are not rendered by default.

Binary file modified site/sitemap.xml.gz
Binary file not shown.
24 changes: 12 additions & 12 deletions site/usage/cookies/index.html
Original file line number Diff line number Diff line change
Expand Up @@ -504,8 +504,8 @@
</li>

<li class="md-nav__item">
<a href="#cookies-and-eu-eprivary-and-gdpr-law" class="md-nav__link">
Cookies and EU ePrivary and GDPR Law
<a href="#cookies-and-eu-eprivacy-and-gdpr-law" class="md-nav__link">
Cookies and EU ePrivacy and GDPR Law
</a>

</li>
Expand Down Expand Up @@ -1650,8 +1650,8 @@
</li>

<li class="md-nav__item">
<a href="#cookies-and-eu-eprivary-and-gdpr-law" class="md-nav__link">
Cookies and EU ePrivary and GDPR Law
<a href="#cookies-and-eu-eprivacy-and-gdpr-law" class="md-nav__link">
Cookies and EU ePrivacy and GDPR Law
</a>

</li>
Expand Down Expand Up @@ -1695,16 +1695,16 @@


<h1 id="cookies-and-privacy">Cookies and Privacy<a class="headerlink" href="#cookies-and-privacy" title="Permanent link"></a></h1>
<p>IXP Manager is open-source and free software. Any individual or organisation who installs IXP Manager and/or makes it available for use must ensure that they are complying with all appropriuate data protection legislation in their jurisdiction as the data controller.</p>
<p>This page details what the developers consider appropropriate information to the best of the knowledge for helping such organisations in with such compliance. </p>
<p>IXP Manager is open-source and free software. Any individual or organisation who installs IXP Manager and/or makes it available for use must ensure that they are complying with all appropriate data protection legislation in their jurisdiction as the data controller.</p>
<p>This page details what the developers consider appropriate information to the best of the knowledge for helping such organisations in with such compliance. </p>
<h2 id="cookies">Cookies<a class="headerlink" href="#cookies" title="Permanent link"></a></h2>
<p>Cookies are small text files that websites place on your device as you are browsing. They are processed and stored by your web browser. Cookies can also generally be easily viewed and deleted. Each cookie is unique to your web browser and will usually contain information such as the cookie name, a unique identifier, and the website's host name or domain name.</p>
<p><strong>IXP Manager</strong> uses a PHP web application framework called Laravel and it generates two encrypted cookies which are required to use the application: </p>
<table>
<thead>
<tr>
<th>Cookie Name</th>
<th>Purpose and Desciption</th>
<th>Purpose and Description</th>
<th>Classification</th>
<th>Lifetime</th>
</tr>
Expand All @@ -1729,15 +1729,15 @@ <h2 id="cookies">Cookies<a class="headerlink" href="#cookies" title="Permanent l
<thead>
<tr>
<th>Cookie Name</th>
<th>Purpose and Desciption</th>
<th>Purpose and Description</th>
<th>Classification</th>
<th>Lifetime</th>
</tr>
</thead>
<tbody>
<tr>
<td><code>remember_web_xxx</code></td>
<td>Session management cookie to facilitate longer sessions and multiple session functionality. These cookies are encypted by the server and only the encrypted version exists on the client side browser. These only contain a session ID. The server records the user's IP address and a browser identifier (e.g. <em>Macintosh 10 / Firefox 109.0</em>) so that users can identify and optionally delete long-lived sessions in the user interface.</td>
<td>Session management cookie to facilitate longer sessions and multiple session functionality. These cookies are encrypted by the server and only the encrypted version exists on the client side browser. These only contain a session ID. The server records the user's IP address and a browser identifier (e.g. <em>Macintosh 10 / Firefox 109.0</em>) so that users can identify and optionally delete long-lived sessions in the user interface.</td>
<td>Strictly Necessary and Opt In</td>
<td>30 days</td>
</tr>
Expand All @@ -1747,7 +1747,7 @@ <h2 id="cookies">Cookies<a class="headerlink" href="#cookies" title="Permanent l
<h3 id="strictly-necessary-cookies">Strictly Necessary cookies<a class="headerlink" href="#strictly-necessary-cookies" title="Permanent link"></a></h3>
<p>Strictly Necessary cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. For example, these cookies let us recognise that you have an account and you have logged into that account. These necessary cookies also allow the portal to remember you and avoid having to log you in on each site visit, or to prevent cross-site scripting security issues.</p>
<p>IXP Manager uses only first-party strictly necessary cookies. IXP Manager does not use third-party cookies.</p>
<h3 id="cookies-and-eu-eprivary-and-gdpr-law">Cookies and EU ePrivary and GDPR Law<a class="headerlink" href="#cookies-and-eu-eprivary-and-gdpr-law" title="Permanent link"></a></h3>
<h3 id="cookies-and-eu-eprivacy-and-gdpr-law">Cookies and EU ePrivacy and GDPR Law<a class="headerlink" href="#cookies-and-eu-eprivacy-and-gdpr-law" title="Permanent link"></a></h3>
<p>As <strong>IXP Manager</strong> generates only <em>Strictly Necessary</em> cookies, it does not need to receive users' consent for the use of these cookies.</p>
<h2 id="data-protection-and-privacy">Data Protection and Privacy<a class="headerlink" href="#data-protection-and-privacy" title="Permanent link"></a></h2>
<p>The following table is a summary of personal data collected by IXP Manager and for what purpose / activity:</p>
Expand All @@ -1760,15 +1760,15 @@ <h2 id="data-protection-and-privacy">Data Protection and Privacy<a class="header
</thead>
<tbody>
<tr>
<td>Contact details including name, position and role, phone number, email address, etc. These are stored on a per mmeber basis and customer admins can also add, edit and remove these.</td>
<td>Contact details including name, position and role, phone number, email address, etc. These are stored on a per member basis and customer admins can also add, edit and remove these.</td>
<td>To manage and facilitate customers / members of an exchange; usually in the performance of a contract.</td>
</tr>
<tr>
<td>Usernames and passwords</td>
<td>To provide members / customers with access to secure areas of IXP Manager; usually in the performance of a contract.</td>
</tr>
<tr>
<td>Login history (IP addreess, date and time)</td>
<td>Login history (IP address, date and time)</td>
<td>To provide an auditable record of when users logged into IXP Manager; usually in compliance with ISMS policies.</td>
</tr>
<tr>
Expand Down

0 comments on commit be3d317

Please sign in to comment.