gitlab-org--gitlab-foss/config/initializers/session_store.rb

# Be sure to restart your server when you modify this file.

Gitlab::Application.config.session_store(
  :redis_store, # Using the cookie_store would enable session replay attacks.
  servers: Gitlab::Application.config.cache_store[1], # re-use the Redis config from the Rails cache store
  key: '_gitlab_session',
  secure: Gitlab.config.gitlab.https,
  httponly: true,
  path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root
)
init commit 2011-10-08 21:36:38 +00:00			`# Be sure to restart your server when you modify this file.`

The cookie store is vulnerable to session replay attacks. 2013-10-11 15:54:38 +00:00			`Gitlab::Application.config.session_store(`
			`:redis_store, # Using the cookie_store would enable session replay attacks.`
Give the Rails cache its own Redis namespace Before this change, Rails cache data was stored in a global Redis namespace. As a consequence, clearing the Rails cache (`rake cache:clear`) would also delete all Sidekiq queue data and session storage. This change puts all Rails cache data in a `cache:gitlab` namespace, making `rake cache:clear` safe again. 2014-04-15 10:11:13 +00:00			`servers: Gitlab::Application.config.cache_store[1], # re-use the Redis config from the Rails cache store`
The cookie store is vulnerable to session replay attacks. 2013-10-11 15:54:38 +00:00			`key: '_gitlab_session',`
Enable secure option if https is used. 2013-12-25 11:30:33 +00:00			`secure: Gitlab.config.gitlab.https,`
The cookie store is vulnerable to session replay attacks. 2013-10-11 15:54:38 +00:00			`httponly: true,`
			`path: (Rails.application.config.relative_url_root.nil?) ? '/' : Rails.application.config.relative_url_root`
			`)`