Commit ce1c7bdb authored by Markus Mößler's avatar Markus Mößler
Browse files

corrected handling of secure cookies

parent 183dc400

tornado-backend/blog.py

+7 −2
Original line number Diff line number Diff line
@@ -129,6 +129,7 @@ class BaseHandler(tornado.web.RequestHandler): 
        # self.current_user in prepare instead.

        # user_id = self.get_signed_cookie("blogdemo_user")

        user_id = self.get_secure_cookie("blogdemo_user")

        # user_id = self.get_cookie("blogdemo_user")

        if user_id:

            self.current_user = await self.queryone(

                "SELECT * FROM authors WHERE id = %s", int(user_id)
@@ -247,7 +248,9 @@ class AuthCreateHandler(BaseHandler): 
            self.get_argument("name"),

            tornado.escape.to_unicode(hashed_password),

        )

        self.set_signed_cookie("blogdemo_user", str(author.id))

        # self.set_signed_cookie("blogdemo_user", str(author.id))

        self.set_secure_cookie("blogdemo_user", str(author.id))

        # self.set_cookie("blogdemo_user", str(author.id))

        self.redirect(self.get_argument("next", "/"))
@@ -274,7 +277,9 @@ class AuthLoginHandler(BaseHandler): 
            tornado.escape.utf8(author.hashed_password),

        )

        if password_equal:

            self.set_signed_cookie("blogdemo_user", str(author.id))

            # self.set_signed_cookie("blogdemo_user", str(author.id))

            self.set_secure_cookie("blogdemo_user", str(author.id))

            # self.set_cookie("blogdemo_user", str(author.id))            

            self.redirect(self.get_argument("next", "/"))

        else:

            self.render("login.html", error="incorrect password")