Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: allow configuring same-site for session cookies #303

Merged
merged 4 commits into from
Mar 21, 2020
+52 −5
Merged

feat: allow configuring same-site for session cookies #303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6eb3208
feat: allow configuring same-site for session cookies
zepatrik Mar 20, 2020
0d278f9
Merge branch 'master' into same-site-cookie
zepatrik Mar 20, 2020
5c636f3
always update SameSite setting to support hot reloading
zepatrik Mar 20, 2020
9ba1071
chore: Regenerate swagger spec and internal client
aeneasr Mar 20, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 30 additions & 0 deletions docs/config.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,15 @@
"$ref": "#/definitions/selfServiceRedirectHook"
},
"uniqueItems": true
},
"cookiesSameSite": {
"type": "string",
"enum": [
"Strict",
"Lax",
"None"
],
"default": "Lax"
}
},
"properties": {
Expand Down Expand Up @@ -588,6 +597,27 @@
}
},
"additionalProperties": false
},
"security": {
"type": "object",
"properties": {
"session": {
"type": "object",
"properties": {
"cookie": {
"type": "object",
"properties": {
"same_site": {
"$ref": "#/definitions/cookiesSameSite"
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"required": [
Expand Down
3 changes: 3 additions & 0 deletions driver/configuration/provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package configuration

import (
"encoding/json"
"net/http"
"net/url"
"time"

Expand Down Expand Up @@ -99,4 +100,6 @@ type Provider interface {
TracingJaegerConfig() *tracing.JaegerConfig

IsInsecureDevMode() bool

SessionSameSiteMode() http.SameSite
}
15 changes: 15 additions & 0 deletions driver/configuration/provider_viper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"bytes"
"encoding/json"
"fmt"
"net/http"
"net/url"
"runtime"
"time"
Expand Down Expand Up @@ -53,6 +54,8 @@ const (

ViperKeyLifespanSession = "ttl.session"

ViperKeySessionSameSite = "security.session.cookie.same_site"

ViperKeySelfServiceStrategyConfig = "selfservice.strategies"
ViperKeySelfServiceRegistrationBeforeConfig = "selfservice.registration.before"
ViperKeySelfServiceRegistrationAfterConfig = "selfservice.registration.after"
Expand Down Expand Up @@ -370,3 +373,15 @@ func (p *ViperProvider) SelfServiceVerificationReturnTo() *url.URL {
func (p *ViperProvider) SelfServicePrivilegedSessionMaxAge() time.Duration {
return viperx.GetDuration(p.l, ViperKeySelfServicePrivilegedAuthenticationAfter, time.Hour)
}

func (p *ViperProvider) SessionSameSiteMode() http.SameSite {
switch viperx.GetString(p.l, ViperKeySessionSameSite, "Lax") {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's make this case-insensitive!

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought we might respect the standard https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#SameSite
but is not really necessary

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I guess you're right, I mean it is being validated in the JSON Schema so it would be easily detectable. I think both ways are ok. What do you think?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's just leave it this way, validation will anyway only allow the capitalized version.

case "Lax":
return http.SameSiteLaxMode
case "Strict":
return http.SameSiteStrictMode
case "None":
return http.SameSiteNoneMode
}
return http.SameSiteDefaultMode
}
3 changes: 2 additions & 1 deletion driver/registry_default.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ type RegistryDefault struct {
schemaHandler *schema.Handler

sessionHandler *session.Handler
sessionsStore sessions.Store
sessionsStore *sessions.CookieStore
sessionManager session.Manager

passwordHasher password2.Hasher
Expand Down Expand Up @@ -279,6 +279,7 @@ func (m *RegistryDefault) CookieManager() sessions.Store {
cs.Options.HttpOnly = true
m.sessionsStore = cs
}
m.sessionsStore.Options.SameSite = m.c.SessionSameSiteMode()
return m.sessionsStore
}

Expand Down
3 changes: 1 addition & 2 deletions internal/httpclient/client/common/get_schema_parameters.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 1 addition & 2 deletions internal/httpclient/client/common/get_schema_responses.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.