From d7876fc9998452e867d9ef49cc7f5d37b5bce6e4 Mon Sep 17 00:00:00 2001 From: Nick Pope Date: Mon, 25 Jun 2018 14:21:21 +0100 Subject: [2.2.x] Updated spelling and RFCs in HttpOnly cookie flag docs. Backport of 398afba084679f1055926f6f91bd33fe124a92c5 from master. --- docs/ref/request-response.txt | 10 ++++------ docs/ref/settings.txt | 16 +++++++--------- 2 files changed, 11 insertions(+), 15 deletions(-) (limited to 'docs/ref') diff --git a/docs/ref/request-response.txt b/docs/ref/request-response.txt index 0c8067c66d..3ab17c08aa 100644 --- a/docs/ref/request-response.txt +++ b/docs/ref/request-response.txt @@ -804,11 +804,9 @@ Methods * Use ``httponly=True`` if you want to prevent client-side JavaScript from having access to the cookie. - HTTPOnly_ is a flag included in a Set-Cookie HTTP response - header. It is not part of the :rfc:`2109` standard for cookies, - and it isn't honored consistently by all browsers. However, - when it is honored, it can be a useful way to mitigate the - risk of a client-side script from accessing the protected cookie + HttpOnly_ is a flag included in a Set-Cookie HTTP response header. It's + part of the :rfc:`6265` standard for cookies and can be a useful way to + mitigate the risk of a client-side script accessing the protected cookie data. * Use ``samesite='Strict'`` or ``samesite='Lax'`` to tell the browser not to send this cookie when performing a cross-origin request. `SameSite`_ @@ -819,7 +817,7 @@ Methods The ``samesite`` argument was added. - .. _HTTPOnly: https://www.owasp.org/index.php/HTTPOnly + .. _HttpOnly: https://www.owasp.org/index.php/HttpOnly .. _SameSite: https://www.owasp.org/index.php/SameSite .. warning:: diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index fa3cc160f7..5ad7846d6a 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -2999,22 +2999,20 @@ This setting also affects cookies set by :mod:`django.contrib.messages`. Default: ``True`` -Whether to use ``HTTPOnly`` flag on the session cookie. If this is set to -``True``, client-side JavaScript will not to be able to access the -session cookie. +Whether to use ``HttpOnly`` flag on the session cookie. If this is set to +``True``, client-side JavaScript will not to be able to access the session +cookie. -HTTPOnly_ is a flag included in a Set-Cookie HTTP response header. It -is not part of the :rfc:`2109` standard for cookies, and it isn't honored -consistently by all browsers. However, when it is honored, it can be a -useful way to mitigate the risk of a client side script accessing the -protected cookie data. +HttpOnly_ is a flag included in a Set-Cookie HTTP response header. It's part of +the :rfc:`6265` standard for cookies and can be a useful way to mitigate the +risk of a client-side script accessing the protected cookie data. This makes it less trivial for an attacker to escalate a cross-site scripting vulnerability into full hijacking of a user's session. There aren't many good reasons for turning this off. Your code shouldn't read session cookies from JavaScript. -.. _HTTPOnly: https://www.owasp.org/index.php/HTTPOnly +.. _HttpOnly: https://www.owasp.org/index.php/HttpOnly .. setting:: SESSION_COOKIE_NAME -- cgit v1.3