{"push_id":2875728269,"size":1,"distinct_size":1,"ref":"refs/heads/btelnes-haw-master-security6","head":"4a1a336bb3f9c674b3064fad7a136188c7853579","before":"3a8161ac2f9209e6f9169c2107c291b45143dde6","commits":[{"sha":"4a1a336bb3f9c674b3064fad7a136188c7853579","author":{"name":"btelnes","email":"4eabc424c31fb57bab7f85ba3122cbf6367d04f6@microsoft.com"},"message":"Update main.yml\n\nSet the EDXAPP_SESSION_COOKIE_SECURE setting to TRUE by default to prevent inadvertent leakage of the session cookie to a \"man-in-the-middle\". The EDXAPP_SESSION_COOKIE_SECURE flag indicates that the cookie should be sent only over an SSL-protected channel. Otherwise, a session hijacker could copy the entire cookie and use it to impersonate the victim. Django's built-in Signer class makes use of a built-in salted_hmac function that derives a usage-specific key from the value of EDXAPP_SECRET_KEY which we auto-generate by default.","distinct":true,"url":"https://api.github.com/repos/Microsoft/edx-configuration/commits/4a1a336bb3f9c674b3064fad7a136188c7853579"}]}
{"actor":{"display_login":"btelnes"}}