mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 22:26:08 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #30304 -- Added support for the HttpOnly, SameSite, and Secure flags on language cookies.

Browse Source
This commit is contained in:
Ran Benita
2019-04-01 12:29:10 +03:00
committed by Mariusz Felisiak
parent cef3f2d3c6
commit 19fc6376ce
6 changed files with 68 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
docs/ref/settings.txt
View File

@@ -1766,6 +1766,21 @@ permanently (via the :setting:`LANGUAGE_COOKIE_NAME` setting) and to add
a middleware that copies the value from the old cookie to a new one and then
deletes the old one.
.. setting:: LANGUAGE_COOKIE_HTTPONLY
``LANGUAGE_COOKIE_HTTPONLY``
----------------------------
.. versionadded:: 3.0
Default: ``False``
Whether to use ``HttpOnly`` flag on the language cookie. If this is set to
``True``, client-side JavaScript will not to be able to access the language
cookie.
See :setting:`SESSION_COOKIE_HTTPONLY` for details on ``HttpOnly``.
.. setting:: LANGUAGE_COOKIE_NAME
``LANGUAGE_COOKIE_NAME``
@@ -1800,6 +1815,33 @@ permanently (via the :setting:`LANGUAGE_COOKIE_NAME` setting), and to add
a middleware that copies the value from the old cookie to a new one and then
deletes the one.
.. setting:: LANGUAGE_COOKIE_SAMESITE
``LANGUAGE_COOKIE_SAMESITE``
----------------------------
.. versionadded:: 3.0
Default: ``None``
The value of the `SameSite`_ flag on the language cookie. This flag prevents the
cookie from being sent in cross-site requests.
See :setting:`SESSION_COOKIE_SAMESITE` for details about ``SameSite``.
.. setting:: LANGUAGE_COOKIE_SECURE
``LANGUAGE_COOKIE_SECURE``
--------------------------
.. versionadded:: 3.0
Default: ``False``
Whether to use a secure cookie for the language cookie. If this is set to
``True``, the cookie will be marked as "secure", which means browsers may
ensure that the cookie is only sent under an HTTPS connection.
.. setting:: LANGUAGES
``LANGUAGES``
@@ -3402,8 +3444,11 @@ Globalization (``i18n``/``l10n``)
* :setting:`LANGUAGE_CODE`
* :setting:`LANGUAGE_COOKIE_AGE`
* :setting:`LANGUAGE_COOKIE_DOMAIN`
* :setting:`LANGUAGE_COOKIE_HTTPONLY`
* :setting:`LANGUAGE_COOKIE_NAME`
* :setting:`LANGUAGE_COOKIE_PATH`
* :setting:`LANGUAGE_COOKIE_SAMESITE`
* :setting:`LANGUAGE_COOKIE_SECURE`
* :setting:`LANGUAGES`
* :setting:`LANGUAGES_BIDI`
* :setting:`LOCALE_PATHS`

6
docs/releases/3.0.txt
View File

@@ -153,7 +153,11 @@ Generic Views
Internationalization
~~~~~~~~~~~~~~~~~~~~
* ...
* Added the :setting:`LANGUAGE_COOKIE_HTTPONLY`,
:setting:`LANGUAGE_COOKIE_SAMESITE`, and :setting:`LANGUAGE_COOKIE_SECURE`
settings to set the ``HttpOnly``, ``SameSite``, and ``Secure`` flags on
language cookies. The default values of these settings preserve the previous
behavior.
Management Commands
~~~~~~~~~~~~~~~~~~~

3
docs/topics/i18n/translation.txt
View File

@@ -1896,7 +1896,10 @@ A number of settings can be used to adjust language cookie options:
* :setting:`LANGUAGE_COOKIE_NAME`
* :setting:`LANGUAGE_COOKIE_AGE`
* :setting:`LANGUAGE_COOKIE_DOMAIN`
* :setting:`LANGUAGE_COOKIE_HTTPONLY`
* :setting:`LANGUAGE_COOKIE_PATH`
* :setting:`LANGUAGE_COOKIE_SAMESITE`
* :setting:`LANGUAGE_COOKIE_SECURE`
Implementation notes
====================