Function _open_session_file

web/pgadmin/utils/session.py:115–132

Open a session file for writing with mode 0o600 (owner-only). Session files contain OAuth access/refresh tokens, AWS/Google/Azure cloud credentials, the Kerberos cache path, MFA OTP material, and `pass_enc_key` (the symmetric KEK used to decrypt the user's saved Postgres server pass

(path)

def _open_session_file(path):
    """Open a session file for writing with mode 0o600 (owner-only).

    Session files contain OAuth access/refresh tokens, AWS/Google/Azure
    cloud credentials, the Kerberos cache path, MFA OTP material,
    and `pass_enc_key` (the symmetric KEK used to decrypt the user's saved
    Postgres server passwords). The default `open(path, 'wb')` uses the
    process umask, which on most systems leaves files world-readable
    (0o644). Force 0o600 so that even if the directory permissions are
    misconfigured (e.g., a volume mount in a container with shared uids),
    individual session files remain owner-only.
    """
    fd = os.open(
        path,
        os.O_WRONLY | os.O_CREAT | os.O_TRUNC,
        0o600,
    )
    return os.fdopen(fd, 'wb')


sess_lock = Lock()