b8ef017610
... instead of setting a httpOnly cookie for admin websocket endpoint which can be CSRFed. With this, we remove the httpOnly tag on jwt cookie so that scripts in admin html pages can access the jwt cookie and authenticates after opening websocket endpoint. Until authenticated using 'auth authToken' command, admin will not respond to any admin command. Also, adapt admin test these changes |
||
---|---|---|
.. | ||
data | ||
.gitignore | ||
countloolkits.hpp | ||
helpers.hpp | ||
httpcrashtest.cpp | ||
httpwstest.cpp | ||
integration-http-server.cpp | ||
Makefile.am | ||
run_unit.sh.in | ||
test.cpp | ||
TileCacheTests.cpp | ||
UnitAdmin.cpp | ||
UnitFonts.cpp | ||
UnitPrefork.cpp | ||
UnitStorage.cpp | ||
UnitTileCache.cpp | ||
UnitTimeout.cpp | ||
WhiteBoxTests.cpp |