Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Error leaks secrets from Session::Cookie #1192

Open
thefatphil opened this issue Aug 16, 2018 · 0 comments
Open

Error leaks secrets from Session::Cookie #1192

thefatphil opened this issue Aug 16, 2018 · 0 comments

Comments

@thefatphil
Copy link
Contributor

D:S:Cookie:
Another setting is also required: session_cookie_key, which should contain a random string of at least 16 characters (shorter keys are not cryptographically strong using AES in CBC mode).
[...]
Compromising session_cookie_key will disclose session data to clients and proxies or eavesdroppers and will also allow tampering, for example session theft.

D:Error.pm sub _censor:
elsif ($key =~ /(pass|card?num|pan|secret|private_key)/i) {

Can the session_cookie_key be censored too?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant