Seafile not using secure cookies by default

Seafile Server
1

Hello,

an external audit of our seafile instance at the university recently complained that seafile is not using secure cookies by default.

I enabled them manually by modifying my seahub_settings.py with the following lines:

SECURE_PROXY_SSL_HEADER = (‘HTTP_X_FORWARDED_PROTO’, ‘https’)
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True
SECURE_SSL_REDIRECT = False

Please consider adding those by default to improve seafile security out of the box.

Thanks,

Ruediger

2

Thank you for the suggestion. Currently, SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE are set to False by default to ensure Seafile remains functional out-of-the-box in non-HTTPS (HTTP) environments, such as local testing or internal setups.

For production environments using HTTPS, these settings should be manually enabled in seahub_settings.py as documented in our admin manual:

We appreciate the feedback regarding making these security settings more prominent or automated (e.g., within the Docker deployment script) and will consider this for future configuration improvements.