Samesite auth cookie #5255
Samesite auth cookie #5255
Conversation
Allows setting the SameSite attribute on the auth cookie, and aligning with what browsers are moving towards to, default it to `Lax` Refactored the code to not rely on string manipulation for modifying the cookie attributes but rather the standard library module. This causes some changes in the case of the attributes and their order but it's worth the extra work. https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#SameSite_cookies
Order attributes before comparing, add tests for SameSite
| # Set secure based on config value. Default is False | ||
| secure = config.get(u'who.secure', False) | ||
| secure = _bool(config.get(u'who.secure', False)) | ||
| # Set samesite based on config value. Default is lax |
There was a problem hiding this comment.
This should be documented as a potentially breaking change (admittedly it shouldn't break sensible setups).
There was a problem hiding this comment.
Changelogs are updated during the release process, so it would be documented there.
| @@ -69,9 +92,15 @@ def make_plugin(secret=None, | |||
| if timeout is not None and reissue_time is None: | |||
| reissue_time = int(math.ceil(int(timeout) * 0.1)) | |||
| # Set httponly based on config value. Default is True | |||
| httponly = config.get(u'who.httponly', True) | |||
| httponly = _bool(config.get(u'who.httponly', True)) | |||
There was a problem hiding this comment.
This should probably be deferred until after we check the attributes that might cause an early termination.
There was a problem hiding this comment.
Boolean conversions were done in CkanAuthTktCookiePlugin call and those variables weren't used in anywhere else, so it makes sense to convert them right away.
|
Note about the change and how to disable it should be added to the release notes. |
|
@Zharktas did you cherry-pick this into the dev-v2.* branches already? If not add the "Backport pending" label otherwise we assume the backport has been done. |
|
@amercader ah right, missed the pending label, added now. |
Adapted version of #5255 PR for 2.8
Adapted version of #5255 PR for 2.8
Adapted version of #5255 PR for 2.8
amercader
added
zBackport 2.8.4
zBackport 2.7.7
zBackport 2.6.9
and removed
zBackport 2.6.10
zBackport 2.7.8
Backport 2.8.4
Backport pending
labels
Allows setting the SameSite attribute on the auth cookie, and aligning with what browsers are moving towards to, default it to
Lax.Refactored the code to not rely on string manipulation for modifying the cookie attributes but rather the standard library module.
This causes some changes in the case of the attributes and their order which means updating the tests, but I think it's worth the extra work.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#SameSite_cookies