search

jazzband / django-revproxy

Reverse Proxy view that supports all HTTP methods, Diazo transformations and Single Sign-On.
Mozilla Public License 2.0
300 stars 118 forks source link

Incorrect handling of "max-age" attribute of HTTP Cookie #161

Open slaxor505 opened 1 year ago

slaxor505 commented 1 year ago

In the code utils.py/cookie_from_string() parses Cookie string and return "max_age" attribute value as string. Then the code sends this value to Django "set_cookie()

revproxy/response.py if cookie_dict: response.set_cookie(**cookie_dict) Which causes exception:

File "/Users/sp/dev/opb-project/openplantbook/venv/lib/python3.9/site-packages/django/http/response.py", line 224, in set_cookie self.cookies[key]['expires'] = http_date(time.time() + max_age) TypeError: unsupported operand type(s) for +: 'float' and 'str'

This is because:

HttpResponse.set_cookie(key, value='', max_age=None, expires=None, path='/', domain=None, secure=False, httponly=False, samesite=None)

Expects max_age as integer:

max_age should be an integer number of seconds, or None (default) if the cookie should last only as long as the client’s browser session. If expires is not specified, it will be calculated.

andruten commented 7 months ago

Hi @slaxor505!

Sorry for the late response. I've opened a PR which should solve this based on the commit you made in your fork.