Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1122291

Summary:	_rails_session cookie not marked as secure
Product:	OpenShift Container Platform	Reporter:	Timothy Williams <tiwillia>
Component:	Security	Assignee:	Brenton Leanhardt <bleanhar>
Status:	CLOSED DUPLICATE	QA Contact:	Xiaoli Tian <xtian>
Severity:	high	Docs Contact:
Priority:	high
Version:	2.1.0	CC:	jialiu, jokerman, lmeyer, mmccomas
Target Milestone:	---	Keywords:	EasyFix
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-07-24 14:45:56 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Timothy Williams 2014-07-22 20:57:48 UTC

Description of problem:
The "_rails_session" cookie created from the console is not marked as secure. This could allow the cookie to be transmitted over non-secure connections. As openshift (by default) requires an https connection, this isn't too much of an issue. However, server-side misconfiguration could lead to the cookie, along with the CSRF token within, to be compromised.

Version-Release number of selected component (if applicable):
2.1

How reproducible:
Always

Comment 2 Luke Meyer 2014-07-23 05:27:56 UTC

I could have sworn this was already in progress. Alright, well, we should do it. Should not be hard.

Comment 3 Brenton Leanhardt 2014-07-24 14:45:56 UTC


*** This bug has been marked as a duplicate of bug 1114111 ***