Greg Von Kuster 3443e25e06 Introducing basic session security - REQUIRES DATABASE SCHEMA CHANGE and REQUIRES CONFIG CHANGE.
SQL commands for schema changes:

ALTER TABLE galaxy_session ADD COLUMN current_history_id INTEGER;
ALTER TABLE galaxy_session ADD FOREIGN KEY (current_history_id) REFERENCES history(id);
ALTER TABLE galaxy_session ADD COLUMN session_key VARCHAR(255) UNIQUE;
ALTER TABLE galaxy_session ADD COLUMN is_valid BOOLEAN DEFAULT false;
ALTER TABLE galaxy_session ADD COLUMN prev_session_id INTEGER;

Galaxy config change:

In the [app:main] section, add:

# Galaxy session security
id_secret = changethisinproductiontoo

1) The "universe", "universe_user" and "universe_session" cookies are deprecated and replaced with 1 new cookie named galaxysession".  The deprecated cookies are still supported and will be for at least 90 days, but when a valid one is found, the value is taken and used to create a new "galaxysession" cookie and the deprecated cookie is immediately expired.

2) The value of the new "galaxysession" cookie is an encrypted unique, high entropy 128 bit random number.  The decoded value is the value stored in the new session_key column of the galaxy_session table.

3) Whenever a user logs in or out they get a new GalaxySession, and the old one in the database is marked as invalidated, so a compromised cookie won't survive across login/logout. Also, when creating the new session, a reference to the previous one is saved ( via the new prev_session_id column in the galaxy_session table ) so we have a way to chain them together.
2008-06-19 14:13:00 +00:00
2008-06-04 01:13:33 +00:00
2008-05-02 19:42:59 +00:00
2007-02-08 20:16:16 +00:00
2008-04-11 20:14:32 +00:00
2007-10-31 19:12:00 +00:00

GALAXY
======
http://g2.bx.psu.edu/

The latest information about Galaxy is always available via the Galaxy
website above.

HOW TO START
============
Galaxy requires Python 2.4 or 2.5. To check your python version, run:

% python -V
Python 2.4.4

Before starting Galaxy for the first time, please run the setup script:

% sh setup.sh

If setup.sh finishes successfully, you can then proceed to starting Galaxy:

% sh run.sh

Once Galaxy completes startup, you should be able to view Galaxy in your
browser at:

http://localhost:8080

You may wish to make changes from the default configuration.  This can be done
in the universe_wsgi.ini file.  Tools are configured in tool_conf.xml.  Details
on adding tools can be found on the Galaxy website (linked above).

Not all dependencies are included for the tools provided in the sample
tool_conf.xml.  A full list of external dependencies is available at:

http://g2.trac.bx.psu.edu/wiki/ToolDependencies
Languages
Python 64.2%
TypeScript 14.5%
Vue 12.5%
JavaScript 3.7%
Jupyter Notebook 2.4%
Other 2.5%