inventree/InvenTree
2
0
Fork 0
mirror of https://github.com/inventree/InvenTree.git synced 2025-06-15 03:25:42 +00:00
Code Activity

Cookie mode (#7162)

Browse Source 
* Add ability to set cookie mode

* Update docs

* Better validation of cookie mode

* Docs updates

* Update error msg

* Update config.md

Change default samesite mode to None

* Update settings.py

Default mode is None

* Update config_template.yaml

Change default value in config file template
This commit is contained in:
Oliver
2024-05-05 17:53:21 +10:00
committed by GitHub
parent 5b0889d4c1
commit e4658eb899
3 changed files with 28 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/backend/InvenTree/InvenTree/settings.py
View File

@ -1106,13 +1106,27 @@ if (
)
sys.exit(-1)
COOKIE_MODE = (
str(get_setting('INVENTREE_COOKIE_SAMESITE', 'cookie.samesite', 'None'))
.lower()
.strip()
)
valid_cookie_modes = {'lax': 'Lax', 'strict': 'Strict', 'none': None, 'null': None}
if COOKIE_MODE not in valid_cookie_modes.keys():
logger.error('Invalid cookie samesite mode: %s', COOKIE_MODE)
sys.exit(-1)
COOKIE_MODE = valid_cookie_modes[COOKIE_MODE.lower()]
# Additional CSRF settings
CSRF_HEADER_NAME = 'HTTP_X_CSRFTOKEN'
CSRF_COOKIE_NAME = 'csrftoken'
CSRF_COOKIE_SAMESITE = 'Lax'
SESSION_COOKIE_SAMESITE = 'Lax'
CSRF_COOKIE_SAMESITE = COOKIE_MODE
SESSION_COOKIE_SAMESITE = COOKIE_MODE
SESSION_COOKIE_SECURE = get_boolean_setting(
'INVENTREE_SESSION_COOKIE_SECURE', 'session_cookie_secure', False
'INVENTREE_SESSION_COOKIE_SECURE', 'cookie.secure', False
)
USE_X_FORWARDED_HOST = get_boolean_setting(

5
src/backend/InvenTree/config_template.yaml
View File

@ -181,6 +181,11 @@ use_x_forwarded_host: false
# Override with the environment variable INVENTREE_USE_X_FORWARDED_PORT
use_x_forwarded_port: false
# Cookie settings
cookie:
secure: false
samesite: none
# Cross Origin Resource Sharing (CORS) settings (see https://github.com/adamchainz/django-cors-headers)
cors:
allow_all: true