Skip to Content
This question has been flagged
cookiesecuretz
2 Respostes
3947 Vistes
Avatar
Kevin Kapfer

Where does odoo set the tz cookie?  My security team flagged the cookie as a security finding as it is not marked for httponly or secure.  

For the session_id, I was able to set this in /odoo/odoo-server/odoo/http.py at about line 1409 by setting the session_id like:

set_cookie('session_id', httprequest.session.sid, max_age=1 * 24 * 60 * 60, secure=True, httponly=True)


I am looking for similar code within odoo and am unable to find it.  The closest I've come is in the same file around line 828 where cookies iterated through and set, but 'tz' is not one of them.

res_partner in the base addons folder looks promising, but it's not quite it either.  Maybe I'm overlooking something. 

Avatar
Descartar
Avatar
Kevin Kapfer
Autor Best Answer

What I settled on for now, is to overwrite the tz cookie with the same value, but adding the secure=True and httponly=True attributes.

           user_tz =  httprequest.cookies.get('tz')


            if user_tz:

                response.set_cookie('tz', user_tz, secure=True, httponly=True)

I am doing this in the dispatch function of http.py inside the "try" block of the dispatch method.  This way, the tz remains whatever was derived, but the cookie is updated to use secure and httponly.   I do not see the UI views to which you refer.  

Avatar
Descartar
Avatar
Ravi Gadhia
Best Answer

The timezone cookie doesn't set by server but it's set by javascript (via script)
https://github.com/odoo/odoo/blob/14.0/addons/web/views/webclient_templates.xml#L480

Avatar
Descartar
Kevin Kapfer
Autor

Thanks Ravi, I saw the line you refer to. Does a change here require rebuilding the Odoo codebase? I made changes here to add httponly and secure attributes but the changes did not appear in the site. I am now pursuing a path of extracting the partner/user's timezone and explicitly setting a 'tz' cookie with httponly and secure.

Ravi Gadhia

if you change it from the XML file it's needs to rebuild/update the module but you can directly change it from odoo UI from views
check the location protocol in javascript and set the cookie if it's https:

Related Posts Respostes Vistes Activitat
How do I get the Website Cookie bar to popup only once at the home page?
cookie
Avatar
Avatar
1
de gen. 23
2571
cookies warning on. web site for cloud version Solved
cookie
Avatar
Avatar
1
de jul. 20
3017
Can i get the value of session0|session_id using JSON-RPC?
cookie
Avatar
0
de març 15
6939
Domain Cookie issue [RESOLVED]
domain cookie
Avatar
0
d’oct. 24
1024
cannot close cookie bar (?)
cookie popup
Avatar
0
de jul. 24
994