diff options
| author | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-10-14 06:57:43 +0000 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com> | 2013-10-14 06:57:43 +0000 |
| commit | fdd64bf347ba728135bc4055592808ed0e315d5d (patch) | |
| tree | 08e85e1ae56e680d16f1d0b05e05c8ed5fb036ff | |
| parent | 41f63acc84ac0f8f348c8393f4094b2aa597461c (diff) | |
| parent | ba7c1764be87f272759471bde01b92dcc147e952 (diff) | |
| download | gitlab-ce-fdd64bf347ba728135bc4055592808ed0e315d5d.tar.gz | |
Merge branch 'cookies-in-redis' of /home/git/repositories/gitlab/gitlabhq
| -rw-r--r-- | CHANGELOG | 1 | ||||
| -rw-r--r-- | config/initializers/session_store.rb | 16 |
2 files changed, 8 insertions, 9 deletions
diff --git a/CHANGELOG b/CHANGELOG index 0d57728367c..1843311d763 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -14,6 +14,7 @@ v 6.2.0 - Extended User API to expose admin and can_create_group for user creation/updating (Boyan Tabakov) - API: Remove group - Avatar upload on profile page with a maximum of 200KB (Steven Thonus) + - Store the sessions in Redis instead of the cookie store v 6.1.0 - Project specific IDs for issues, mr, milestones diff --git a/config/initializers/session_store.rb b/config/initializers/session_store.rb index 52a099c3e16..501cad4a838 100644 --- a/config/initializers/session_store.rb +++ b/config/initializers/session_store.rb @@ -1,11 +1,9 @@ # Be sure to restart your server when you modify this file. -Gitlab::Application.config.session_store :cookie_store, key: '_gitlab_session', - secure: Gitlab::Application.config.force_ssl, - httponly: true, - path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root - -# Use the database for sessions instead of the cookie-based default, -# which shouldn't be used to store highly confidential information -# (create the session table with "rails generate session_migration") -# Gitlab::Application.config.session_store :active_record_store +Gitlab::Application.config.session_store( + :redis_store, # Using the cookie_store would enable session replay attacks. + key: '_gitlab_session', + secure: Gitlab::Application.config.force_ssl, + httponly: true, + path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root +) |