Skip ke Konten
Pertanyaan ini telah diberikan tanda
cookiesecuretz
2 Replies
4025 Tampilan
Avatar
Kevin Kapfer

Where does odoo set the tz cookie?  My security team flagged the cookie as a security finding as it is not marked for httponly or secure.  

For the session_id, I was able to set this in /odoo/odoo-server/odoo/http.py at about line 1409 by setting the session_id like:

set_cookie('session_id', httprequest.session.sid, max_age=1 * 24 * 60 * 60, secure=True, httponly=True)


I am looking for similar code within odoo and am unable to find it.  The closest I've come is in the same file around line 828 where cookies iterated through and set, but 'tz' is not one of them.

res_partner in the base addons folder looks promising, but it's not quite it either.  Maybe I'm overlooking something. 

Avatar
Buang
Avatar
Kevin Kapfer
Penulis Jawaban Terbai

What I settled on for now, is to overwrite the tz cookie with the same value, but adding the secure=True and httponly=True attributes.

           user_tz =  httprequest.cookies.get('tz')


            if user_tz:

                response.set_cookie('tz', user_tz, secure=True, httponly=True)

I am doing this in the dispatch function of http.py inside the "try" block of the dispatch method.  This way, the tz remains whatever was derived, but the cookie is updated to use secure and httponly.   I do not see the UI views to which you refer.  

Avatar
Buang
Avatar
Ravi Gadhia
Jawaban Terbai

The timezone cookie doesn't set by server but it's set by javascript (via script)
https://github.com/odoo/odoo/blob/14.0/addons/web/views/webclient_templates.xml#L480

Avatar
Buang
Kevin Kapfer
Penulis

Thanks Ravi, I saw the line you refer to. Does a change here require rebuilding the Odoo codebase? I made changes here to add httponly and secure attributes but the changes did not appear in the site. I am now pursuing a path of extracting the partner/user's timezone and explicitly setting a 'tz' cookie with httponly and secure.

Ravi Gadhia

if you change it from the XML file it's needs to rebuild/update the module but you can directly change it from odoo UI from views
check the location protocol in javascript and set the cookie if it's https:

Post Terkait Replies Tampilan Aktivitas
How do I get the Website Cookie bar to popup only once at the home page?
cookie
Avatar
Avatar
1
Jan 23
2642
cookies warning on. web site for cloud version Diselesaikan
cookie
Avatar
Avatar
1
Jul 20
3086
Can i get the value of session0|session_id using JSON-RPC?
cookie
Avatar
0
Mar 15
7036
Domain Cookie issue [RESOLVED]
domain cookie
Avatar
0
Okt 24
1115
cannot close cookie bar (?)
cookie popup
Avatar
0
Jul 24
1042