OpenStack Object Storage (swift)

  1. Bug #1463698
  2. Comment #28

Comment 28 for bug 1463698

Revision history for this message
Lin Hua Cheng (lin-hua-cheng) wrote :

Amit failed to respond to an important question, if horizon and swift is running on the same domain.

From the screenshot, the image is opened using the Swift Public URL endpoint.

And it seems like Swift is running on the same domain as horizon, allowing the script to access the horizon cookie.

The reported bug is invalid for Horizon.

This is more of a deployment issue.

Horizon already documented configuration how to avoid XSS attack in: https://github.com/openstack/horizon/blob/master/doc/source/topics/deployment.rst

By setting:
CSRF_COOKIE_HTTPONLY = True
SESSION_COOKIE_HTTPONLY = True