Ir al contenido
Se marcó esta pregunta
cookiesecuretz
2 Respuestas
3880 Vistas
Avatar
Kevin Kapfer

Where does odoo set the tz cookie?  My security team flagged the cookie as a security finding as it is not marked for httponly or secure.  

For the session_id, I was able to set this in /odoo/odoo-server/odoo/http.py at about line 1409 by setting the session_id like:

set_cookie('session_id', httprequest.session.sid, max_age=1 * 24 * 60 * 60, secure=True, httponly=True)


I am looking for similar code within odoo and am unable to find it.  The closest I've come is in the same file around line 828 where cookies iterated through and set, but 'tz' is not one of them.

res_partner in the base addons folder looks promising, but it's not quite it either.  Maybe I'm overlooking something. 

Avatar
Descartar
Avatar
Kevin Kapfer
Autor Mejor respuesta

What I settled on for now, is to overwrite the tz cookie with the same value, but adding the secure=True and httponly=True attributes.

           user_tz =  httprequest.cookies.get('tz')


            if user_tz:

                response.set_cookie('tz', user_tz, secure=True, httponly=True)

I am doing this in the dispatch function of http.py inside the "try" block of the dispatch method.  This way, the tz remains whatever was derived, but the cookie is updated to use secure and httponly.   I do not see the UI views to which you refer.  

Avatar
Descartar
Avatar
Ravi Gadhia
Mejor respuesta

The timezone cookie doesn't set by server but it's set by javascript (via script)
https://github.com/odoo/odoo/blob/14.0/addons/web/views/webclient_templates.xml#L480

Avatar
Descartar
Kevin Kapfer
Autor

Thanks Ravi, I saw the line you refer to. Does a change here require rebuilding the Odoo codebase? I made changes here to add httponly and secure attributes but the changes did not appear in the site. I am now pursuing a path of extracting the partner/user's timezone and explicitly setting a 'tz' cookie with httponly and secure.

Ravi Gadhia

if you change it from the XML file it's needs to rebuild/update the module but you can directly change it from odoo UI from views
check the location protocol in javascript and set the cookie if it's https:

Publicaciones relacionadas Respuestas Vistas Actividad
How do I get the Website Cookie bar to popup only once at the home page?
cookie
Avatar
Avatar
1
ene 23
2522
cookies warning on. web site for cloud version Resuelto
cookie
Avatar
Avatar
1
jul 20
2973
Can i get the value of session0|session_id using JSON-RPC?
cookie
Avatar
0
mar 15
6900
Domain Cookie issue [RESOLVED]
domain cookie
Avatar
0
oct 24
998
cannot close cookie bar (?)
cookie popup
Avatar
0
jul 24
966