enhancement: Make IDP cookies same site strict #8716
Conversation
fschade
force-pushed
the
same-site-cookie-setting
branch
from
1eadbbf to
a33421d
Compare
|
@rhafer not sure if this is bogus.... can we have a look together? |
fschade
force-pushed
the
same-site-cookie-setting
branch
from
a33421d to
ad497c3
Compare
To enhance the security of our application and prevent Cross-Site Request Forgery (CSRF) attacks, we have updated the SameSite attribute of the build in Identity Provider (IDP) cookies to Strict.
fschade
force-pushed
the
same-site-cookie-setting
branch
from
ad497c3 to
992d15c
Compare
fschade
changed the title
|
fschade
requested review from
dragonchaser
and removed request for
dragonchaser
|
@dj4oC if i understood you correct no backport for that? |
| @@ -112,6 +113,7 @@ type Settings struct { | |||
|
|
|||
| CookieBackendURI string | |||
| CookieNames []string | |||
| CookieSameSite http.SameSite | |||
There was a problem hiding this comment.
IMHO we should have an env-var & yaml annotation to configure that.
There was a problem hiding this comment.
i think no, since the idp is meant for internal use only... am i right?
There was a problem hiding this comment.
but on the same site.... im not against it... 🤣
There was a problem hiding this comment.
if you decide to have it, can u take over and add it? i expect load testing will consume most of my day
There was a problem hiding this comment.
wait yes you are right... this does not affect external idp configurations afaik....
There was a problem hiding this comment.
unless we provide the ability to authenticate extenal apps via the internal idp this is not needed....
To enhance the security of our application and prevent Cross-Site Request Forgery (CSRF) attacks, we have updated the SameSite attribute of the build in Identity Provider (IDP) cookies to Strict.
|
Correct |
|
I'll do a backport for stable 5 |
To enhance the security of our application and prevent Cross-Site Request Forgery (CSRF) attacks, we have updated the SameSite attribute of the build in Identity Provider (IDP) cookies to Strict.
Description
To enhance the security of our application and prevent Cross-Site Request Forgery (CSRF) attacks, we have updated the SameSite attribute of the build in Identity Provider (IDP) cookies to Strict.
This change restricts the browser from sending these cookies with any cross-site requests,
thereby limiting the exposure of the user's session to potential threats.
This update does not impact the existing functionality of the application but provides an additional layer of security
where needed.
Needs libregraph/lico#131 ✅
https://www.authelia.com/configuration/session/introduction/#same_site-1
Related Issue
Motivation and Context
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesitesamesite-value
How Has This Been Tested?
Types of changes
Checklist: