add hash, key for secure cookie.

why2pac · Aug 31, 2017 · 9c7ac4f · 9c7ac4f
1 parent e4d1315
commit 9c7ac4f
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/dp_tornado/engine/handler.py b/dp_tornado/engine/handler.py
@@ -367,6 +367,7 @@ def remote_ip(self):
 
     def set_secure_cookie(self, name, value, expires_days=30, version=2, **kwargs):
         key = self.request.headers["User-Agent"] if "User-Agent" in self.request.headers else 'unknown'
+        key = self.helper.security.crypto.hash.sha224(key)
 
         if self.ini.session.ip_restricted:
             key = '%s:%s' % (self.remote_ip, key)
@@ -381,6 +382,7 @@ def get_secure_cookie(self, name, value=None, max_age_days=31, min_version=None)
         if secure_cookie:
             try:
                 key = self.request.headers["User-Agent"] if "User-Agent" in self.request.headers else 'unknown'
+                key = self.helper.security.crypto.hash.sha224(key)
 
                 if self.ini.session.ip_restricted:
                     key = '%s:%s' % (self.remote_ip, key)