570686 - [SSO] Bind session cookie to client IP address

Status: RESOLVED FIXED

(Webtools Graveyard :: SSO (Legacy), defect, P1)

Description

[Fred Wenzel [:wenzel]]

Much like we do on bugzilla and other places, the SSO session cookie should be valid for its original IP address only.

Comment 1

[Fred Wenzel [:wenzel]]

This is fixed:
http://github.com/mozilla/secret-squirrel/commit/85b5f61

Notes:
- I used django-paranoid-sessions[1], which can do even more to ensure session safety than what we are using it for now. I only switched on remote IP checking, however. Michael, you might want to check out what else that package offers, for inspiration :).
- I wrote a test that ensures an established session is logged out when the client IP changes.
- I am using commonware's remote IP middleware to check the client IP vs. our load balancer's IP (which would be useless).
- Ozten: You have to ``pip install -r requirements/dev.txt``.


[1] http://github.com/rfk/django-paranoid-sessions/