stackforge/puppet-horizon — pull request #5 by pruby (2014-10-20 04:02:06+00:00)
Title: Add selection of Django session engine to this module

This allows Django to be set to use something other than the default session engine through Puppet.

We've added this because our security constraints make signed cookies as a session store for Horizon undesirable. The reasons for this are:

* Sessions become vulnerable to replay attacks, true log-out is difficult to achieve.
* Serialising sessions in cookies allows an attacker to escalate read-only access to server configuration in to code execution.