Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TET-880: Use secure cookie flag everywhere #5956

Merged
merged 1 commit into from
Feb 14, 2025

Conversation

baarkerlounger
Copy link
Contributor

@baarkerlounger baarkerlounger commented Feb 14, 2025

Description of change

https://uktrade.atlassian.net/browse/TET-880

The Django admin messages contrib module takes it's cookie settings from the general Django config. The SESSION_COOKIE_SECURE setting defaults to off, which means the messages cookies were also being created with the flag off, for example in the request below. This was flagged in the most recent pen test. e.g.:

POST http://localhost:8000/admin/company/advisor/f4a33f93-6303-4a7e-a813-ab4c204df2e3/change/

Before:
Screenshot 2025-02-14 at 11 57 56

After:
Screenshot 2025-02-14 at 11 54 39

Checklist

  • Has this branch been rebased on top of the current main branch?

    Explanation

    The branch should not be stale or have conflicts at the time reviews are requested.

  • Is the CircleCI build passing?

General points

Other things to check

  • Make sure fixtures/test_data.yaml is maintained when updating models
  • Consider the admin site when making changes to models
  • Use select-/prefetch-related field lists in views and search apps, and update them when fields are added
  • Make sure the README is updated e.g. when adding new environment variables

See docs/CONTRIBUTING.md for more guidelines.

@baarkerlounger baarkerlounger requested a review from a team as a code owner February 14, 2025 11:57
Copy link

codecov bot commented Feb 14, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.64%. Comparing base (a2b9325) to head (31ac881).
Report is 6 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #5956      +/-   ##
==========================================
- Coverage   96.65%   96.64%   -0.01%     
==========================================
  Files        1077     1077              
  Lines       25330    25330              
  Branches     1669     1669              
==========================================
- Hits        24482    24481       -1     
- Misses        691      692       +1     
  Partials      157      157              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

@dredmonds dredmonds left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM👍

Copy link
Contributor

@stuart-mindt stuart-mindt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@baarkerlounger baarkerlounger merged commit 170b1a3 into main Feb 14, 2025
7 checks passed
@baarkerlounger baarkerlounger deleted the TET-880-Cookie-secure-flag branch February 14, 2025 14:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants