database/doris
2
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

[fix](httpserver) creating this cookie without the "secure" flag and enabling cross-origin resource safe (#25107)

Browse Source
This commit is contained in:
Petrichor
2023-10-10 06:25:09 -05:00
committed by GitHub
parent 8b56ca84c7
commit 67ddfb1abc
3 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
fe/fe-core/src/main/java/org/apache/doris/httpv2/config/WebConfigurer.java
View File

@ -48,7 +48,7 @@ public class WebConfigurer implements WebMvcConfigurer {
registry.addMapping("/**")
.allowCredentials(false)
.allowedMethods("*")
.allowedOrigins("*")
.allowedOrigins(Config.access_control_allowed_origin_domain)
.allowedHeaders("*")
.maxAge(3600);
}

1
fe/fe-core/src/main/java/org/apache/doris/httpv2/controller/BaseController.java
View File

@ -103,6 +103,7 @@ public class BaseController {
protected void addSession(HttpServletRequest request, HttpServletResponse response, SessionValue value) {
String key = UUID.randomUUID().toString();
Cookie cookie = new Cookie(PALO_SESSION_ID, key);
cookie.setSecure(true);
cookie.setMaxAge(PALO_SESSION_EXPIRED_TIME);
cookie.setPath("/");
cookie.setHttpOnly(true);