The "message" cookie is not marked as "secure"

[Zhang Yun]

The message cookie is not marked as 'secure', as identified by the following security report. If might contain sensitive information, and would benefit from being marked as secure.

---

Affected URL: https://Ip_address/settings/
Affected Entity: messages, django_timezone, horizon_pagesize, and horizon_language
Risk: It may be possible to steal user and session information (cookies) that was sent during an encrypted session

Causes: The web application sends non-secure cookies over SSL

Recommend Fix: Add the 'Secure' attribute to all sensitive cookies

[Doug Fish (drfish)]

Zhang Yun, based on our other conversation I think you might have misstated the issue for this bug.

I think the concern is that the cookies for messages, django_timezone,horizon_pagesize, and horizon_language are not marked as "secure". Is that right? If so, please update the title and remove the sample response (it doesn't show those cookies).

[Zhang Yun (zhangyun)]

Thanks Doug, I updated the title and removed sample response.

[Zhang Yun (zhangyun)]

Hi Doug, I modified the title and removed the sample response according to your comments. Would you please take some time to re-investigate it? Thanks.

[Gary W. Smith (gary-w-smith)]

These fields don't contain sensitive information, so why do they need to be marked secure? Can you help explain what is the security risk is here?

[Zhang Yun (zhangyun)]

Ok, if no sensitive information here, please close this bug, thanks.

[Julie Pichon (jpichon)]

It may be worth considering for the "messages" cookie?

[Gary W. Smith (gary-w-smith)]

Good catch, Julie. There are probably some messages that could have sensitive info in them. It appears that as of Django 1.7, this can be made sure via the SESSION_COOKIE_SECURE setting ( https://docs.djangoproject.com/en/dev/ref/settings/#session-cookie-secure)

[Kent Wang (k.wang)]

Hi I'm unable to find the 'messages' cookie or form field in settings. Is it still there now?

[Kent Wang (k.wang)]

Marking as incomplete. May already be fixed

[Rob Cresswell (robcresswell-deactivatedaccount)]

The default value for SESSION_COOKIE_SECURE is False, but the deployment guide advises changing it to True.