mirror of
https://github.com/galaxyproject/galaxy.git
synced 2026-10-25 00:12:08 +08:00
Greg Von Kuster
3443e25e06
SQL commands for schema changes: ALTER TABLE galaxy_session ADD COLUMN current_history_id INTEGER; ALTER TABLE galaxy_session ADD FOREIGN KEY (current_history_id) REFERENCES history(id); ALTER TABLE galaxy_session ADD COLUMN session_key VARCHAR(255) UNIQUE; ALTER TABLE galaxy_session ADD COLUMN is_valid BOOLEAN DEFAULT false; ALTER TABLE galaxy_session ADD COLUMN prev_session_id INTEGER; Galaxy config change: In the [app:main] section, add: # Galaxy session security id_secret = changethisinproductiontoo 1) The "universe", "universe_user" and "universe_session" cookies are deprecated and replaced with 1 new cookie named galaxysession". The deprecated cookies are still supported and will be for at least 90 days, but when a valid one is found, the value is taken and used to create a new "galaxysession" cookie and the deprecated cookie is immediately expired. 2) The value of the new "galaxysession" cookie is an encrypted unique, high entropy 128 bit random number. The decoded value is the value stored in the new session_key column of the galaxy_session table. 3) Whenever a user logs in or out they get a new GalaxySession, and the old one in the database is marked as invalidated, so a compromised cookie won't survive across login/logout. Also, when creating the new session, a reference to the previous one is saved ( via the new prev_session_id column in the galaxy_session table ) so we have a way to chain them together.