mconf-web icon indicating copy to clipboard operation
mconf-web copied to clipboard

Use a unique name for the session cookie

Open mconf-daileon opened this issue 8 years ago • 0 comments


Author Name: Leonardo Daronco (Leonardo Daronco) Original Redmine Issue: 1797, http://dev.mconf.org/redmine/issues/1797


We currently use a hard-coded name for the session cookie, see https://github.com/mconf/mconf-web/blob/d6bbc72b4dc507db3cbc3ad48b2bfe45a2e3b171/config/initializers/session_store.rb#L9 If two different websites/domains use Mconf-Web, the cookies will conflict: signing in one website will sign out of the other. This can be easily tested running the application in development twice (e.g. on ports 3000 and 3001).

This cookie should use a unique name for each instance of Mconf-Web. It could use a randomly generated value (as the secret tokens, for example) or even use the name of the website as configured by the user.

mconf-daileon avatar May 08 '16 16:05 mconf-daileon