Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Don't enable secure cookies when they won't work #9971

Merged
merged 3 commits into from Mar 17, 2019
Merged

Don't enable secure cookies when they won't work #9971

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b54ae4e
Ignore session.cookie_secure errors
murrant Mar 15, 2019
c8a2af9
Don't allow secure cookies to be enabled when not accessing via https
murrant Mar 17, 2019
dd6d41e
Completely remove the setting
murrant Mar 17, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 0 additions & 4 deletions LibreNMS/Config.php
View file
Open in desktop
Expand Up @@ -442,10 +442,6 @@ private static function processConfig($persist = true)
self::set('email_from', '"' . self::get('project_name') . '" <' . self::get('email_user') . '@' . php_uname('n') . '>');
}

if (self::get('secure_cookies')) {
ini_set('session.cookie_secure', 1);
}

// If we're on SSL, let's properly detect it
if (isset($_SERVER['HTTPS'])) {
self::set('base_url', preg_replace('/^http:/', 'https:', self::get('base_url')));
Expand Down
3 changes: 0 additions & 3 deletions doc/General/Security.md
View file
Open in desktop
Expand Up @@ -13,9 +13,6 @@ a firewall or VPN.
It is also highly recommended that the Web interface is protected with an SSL certificate such as ones
provided by [LetsEncrypt](http://www.letsencrypt.org).

When using HTTPS, it is recommended that you use secure, encrypted cookies to prevent session
hijacking attacks. Set ``$config['secure_cookies'] = true;`` in ``config.php`` to enable these.

Please ensure you keep your install [up to date](Updating.md).

### Reporting vulnerabilities
Expand Down
7 changes: 0 additions & 7 deletions includes/defaults.inc.php
View file
Open in desktop
Expand Up @@ -982,13 +982,6 @@
// Graphite default port
$config['graphite']['port'] = 2003;

// Whether to enable secure cookies. Setting this to true enable secure cookies
// and only send them over HTTPS. Setting this to false will send cookies over
// HTTP and HTTPS, but they will be insecure. Setting this to $_SERVER["HTTPS"]
// will send secure cookies when the site is being accessed over HTTPS, and
// send insecure cookies when the site is being accessed over HTTP.
$config['secure_cookies'] = isset($_SERVER["HTTPS"]) ? $_SERVER["HTTPS"] : false;

// API config
$config['api']['cors']['enabled'] = false;
$config['api']['cors']['origin'] = '*';
Expand Down