diff options
author | Sean McGivern <sean@mcgivern.me.uk> | 2018-09-03 11:46:27 +0300 |
---|---|---|
committer | Sean McGivern <sean@mcgivern.me.uk> | 2018-09-03 11:46:27 +0300 |
commit | 61ffa04d28ba5d8c522658c5c640009dd7991ec5 (patch) | |
tree | cff9d200861bb48d9f124b6d3cce8e8f0ceb6239 | |
parent | de4c76bb0f76f67e29702c9c62b13e4178d68ae5 (diff) | |
parent | 4442972b060593b045254668af32658382f18e6b (diff) |
Merge branch 'sh-disable-sidekiq-session' into 'master'
Disable the Sidekiq Admin Rack session
See merge request gitlab-org/gitlab-ce!21441
-rw-r--r-- | changelogs/unreleased/sh-disable-sidekiq-session.yml | 5 | ||||
-rw-r--r-- | config/initializers/sidekiq.rb | 6 |
2 files changed, 11 insertions, 0 deletions
diff --git a/changelogs/unreleased/sh-disable-sidekiq-session.yml b/changelogs/unreleased/sh-disable-sidekiq-session.yml new file mode 100644 index 00000000000..d018bbed841 --- /dev/null +++ b/changelogs/unreleased/sh-disable-sidekiq-session.yml @@ -0,0 +1,5 @@ +--- +title: Disable the Sidekiq Admin Rack session +merge_request: 21441 +author: +type: security diff --git a/config/initializers/sidekiq.rb b/config/initializers/sidekiq.rb index 6f54bee4713..476eaabfed8 100644 --- a/config/initializers/sidekiq.rb +++ b/config/initializers/sidekiq.rb @@ -1,3 +1,9 @@ +require 'sidekiq/web' + +# Disable the Sidekiq Rack session since GitLab already has its own session store. +# CSRF protection still works (https://github.com/mperham/sidekiq/commit/315504e766c4fd88a29b7772169060afc4c40329). +Sidekiq::Web.set :sessions, false + # Custom Queues configuration queues_config_hash = Gitlab::Redis::Queues.params queues_config_hash[:namespace] = Gitlab::Redis::Queues::SIDEKIQ_NAMESPACE |