tz cookie

Question

Where does odoo set the tz cookie?  My security team flagged the cookie as a security finding as it is not marked for httponly or secure.
For the session_id, I was able to set this in /odoo/odoo-server/odoo/http.py at about line 1409 by setting the session_id like:
set_cookie('session_id', httprequest.session.sid, max_age=1 * 24 * 60 * 60, secure=*True*, httponly=*True*)

I am looking for similar code within odoo and am unable to find it.  The closest I've come is in the same file around line 82

Kevin Kapfer · Answer

What I settled on for now, is to overwrite the tz cookie with the same value, but adding the secure=True and httponly=True attributes.
user_tz =  httprequest.cookies.get('tz')

if user_tz:
response.set_cookie('tz', user_tz, secure=*True*, httponly=*True*)
I am doing this in the dispatch function of http.py inside the "try" block of the dispatch method.  This way, the tz remains whatever was derived, but the cookie is updated to use secure and httponly.   I do not see the UI views to which you r

Ravi Gadhia · Answer

The timezone cookie doesn't set by server but it's set by javascript (via script)
https://github.com/odoo/odoo/blob/14.0/addons/web/views/webclient_templates.xml#L480 [1]

[1] https://github.com/odoo/odoo/blob/14.0/addons/web/views/webclient_templates.xml#L480

Powiązane posty	Odpowiedzi	Widoki
How do I get the Website Cookie bar to popup only once at the home page? cookie	1 sty 23	3213
cookies warning on. web site for cloud version Rozwiązane cookie	1 lip 20	3540
Can i get the value of session0\|session_id using JSON-RPC? cookie	0 mar 15	7650
Domain Cookie issue [RESOLVED] domain cookie	0 paź 24	1642
cannot close cookie bar (?) cookie popup	0 lip 24	1554

To pytanie dostało ostrzeżenie

Podoba Ci się ta dyskusja? Dołącz do niej!