Fixed #20972 -- Make messages cookie follow session cookie secure/httponly

2 files changed, 10 insertions, 6 deletions

diff --git a/django/contrib/messages/storage/cookie.py b/django/contrib/messages/storage/cookie.py
index 619c69249e..8c394d2046 100644
--- a/django/contrib/messages/storage/cookie.py
+++ b/django/contrib/messages/storage/cookie.py
@@ -79,7 +79,9 @@ class CookieStorage(BaseStorage):
         """
         if encoded_data:
             response.set_cookie(self.cookie_name, encoded_data,
-                domain=settings.SESSION_COOKIE_DOMAIN)
+                domain=settings.SESSION_COOKIE_DOMAIN,
+                secure=settings.SESSION_COOKIE_SECURE or None,
+                httponly=settings.SESSION_COOKIE_HTTPONLY or None)
         else:
             response.delete_cookie(self.cookie_name,
                 domain=settings.SESSION_COOKIE_DOMAIN)
diff --git a/django/contrib/messages/tests/test_cookie.py b/django/contrib/messages/tests/test_cookie.py
index 5871ecc773..e57cc33946 100644
--- a/django/contrib/messages/tests/test_cookie.py
+++ b/django/contrib/messages/tests/test_cookie.py
@@ -41,7 +41,7 @@ def stored_cookie_messages_count(storage, response):
     return len(data)
 
 
-@override_settings(SESSION_COOKIE_DOMAIN='.example.com')
+@override_settings(SESSION_COOKIE_DOMAIN='.example.com', SESSION_COOKIE_SECURE=True, SESSION_COOKIE_HTTPONLY=True)
 class CookieTest(BaseTests, TestCase):
     storage_class = CookieStorage
 
@@ -56,10 +56,10 @@ class CookieTest(BaseTests, TestCase):
         # Test that the message actually contains what we expect.
         self.assertEqual(list(storage), example_messages)
 
-    def test_domain(self):
+    def test_cookie_setings(self):
         """
-        Ensure that CookieStorage honors SESSION_COOKIE_DOMAIN.
-        Refs #15618.
+        Ensure that CookieStorage honors SESSION_COOKIE_DOMAIN, SESSION_COOKIE_SECURE and SESSION_COOKIE_HTTPONLY
+        Refs #15618 and #20972.
         """
         # Test before the messages have been consumed
         storage = self.get_storage()
@@ -69,8 +69,10 @@ class CookieTest(BaseTests, TestCase):
         self.assertTrue('test' in response.cookies['messages'].value)
         self.assertEqual(response.cookies['messages']['domain'], '.example.com')
         self.assertEqual(response.cookies['messages']['expires'], '')
+        self.assertEqual(response.cookies['messages']['secure'], True)
+        self.assertEqual(response.cookies['messages']['httponly'], True)
 
-        # Test after the messages have been consumed
+        # Test deletion of the cookie (storing with an empty value) after the messages have been consumed
         storage = self.get_storage()
         response = self.get_response()
         storage.add(constants.INFO, 'test')