mconf-web
mconf-web copied to clipboard
Use a unique name for the session cookie
Author Name: Leonardo Daronco (Leonardo Daronco) Original Redmine Issue: 1797, http://dev.mconf.org/redmine/issues/1797
We currently use a hard-coded name for the session cookie, see https://github.com/mconf/mconf-web/blob/d6bbc72b4dc507db3cbc3ad48b2bfe45a2e3b171/config/initializers/session_store.rb#L9 If two different websites/domains use Mconf-Web, the cookies will conflict: signing in one website will sign out of the other. This can be easily tested running the application in development twice (e.g. on ports 3000 and 3001).
This cookie should use a unique name for each instance of Mconf-Web. It could use a randomly generated value (as the secret tokens, for example) or even use the name of the website as configured by the user.