Page MenuHomeIn-Portal Phabricator

INP-1725 - Introduce secure Session Key generation/storage
Needs ReviewPublic

Authored by alex on Tue, Mar 4, 9:30 AM.

Details

Reviewers
erik
Summary

Restores the ability to specify SID in the URL, which was lost after D479 was implemented.

Test Plan

How to enable/disable cookies on a page in the Firefox

  1. open the page
  2. click on the ToolsPage info menu of the Firefox
  3. click on the Permissions tab
  4. scroll to the Set cookies entry
  5. to enable cookie support:
    1. uncheck the Use Default checkbox
    2. select the Allow radio button in the same row
  6. to disable cookie support:
    1. uncheck the Use Default checkbox
    2. select the Block radio button in the same row
  7. close the Page info window to save changes

P.S. Checking the Use Default checkbox is always blocking cookies for me.

Test Plan

  1. make sure that cookies are enabled in the Web Browser (see above)
  2. login to the Admin Console
  3. go to the ConfigurationWebsiteAdvanced section
  4. set the Session Management Method to the Auto-Detect
  5. set the Session Cookie Domains (single domain per line) to the used domain (e.g. if the current page URL is https://my.custom.domain.com/path/to/in-portal/admin/..., then cookie domain would be my.custom.domain.com)
  6. save changes
  7. delete all cookies that are set on smaller depth levels of the used cookie domain (e.g. for the my.custom.domain.com domain cookies must be deleted on the custom.domain.com and domain.com domains)
  8. logout
  9. go to the Front-End (the advanced theme)
  10. login
  11. open any login-protected page
  12. confirm that session id is present in the URL
  13. confirm that you can browse the website while being logged in with cookies disabled
  14. press the Logout link in the left sidebar
  15. confirm that you're logged out

Diff Detail

Repository
rINP In-Portal
Branch
/in-portal/branches/5.2.x
Lint
Lint ErrorsExcuse: Unrelated.
SeverityLocationCodeMessage
Errorcore/kernel/session/session.php:88PHPCS.E.CodingStandard.Classes.PropertyDeclaration.ScopeMissingCodingStandard.Classes.PropertyDeclaration.ScopeMissing
Errorcore/kernel/session/session.php:88PHPCS.E.CodingStandard.Classes.PropertyDeclaration.VarUsedCodingStandard.Classes.PropertyDeclaration.VarUsed
Errorcore/kernel/session/session.php:88PHPCS.E.CodingStandard.NamingConventions.ValidVariableName.MemberNotCamelCapsCodingStandard.NamingConventions.ValidVariableName.MemberNotCamelCaps
Errorcore/kernel/session/session.php:88PHPCS.E.Squiz.Commenting.VariableComment.MissingSquiz.Commenting.VariableComment.Missing
Unit
No Unit Test Coverage
Build Status
Buildable 11064
Build 3764: arc lint + arc unit

Event Timeline

alex created this revision.Tue, Mar 4, 9:30 AM
alex requested review of this revision.Tue, Mar 4, 9:30 AM
alex edited the test plan for this revision. (Show Details)Tue, Mar 4, 9:31 AM
alex added a parent revision: Restricted Differential Revision.
alex edited the summary of this revision. (Show Details)Tue, Mar 4, 9:56 AM