all lists on lists.proxmox.com
 help / color / mirror / Atom feed
* [pve-devel] [PATCH widget-toolkit/http-server/apiclient 0/4] Set SameSite=Strict on Auth Cookies
@ 2023-03-15 16:26 Max Carrara
  2023-03-15 16:26 ` [pve-devel] [PATCH proxmox-widget-toolkit 1/4] toolkit/utils: set SameSite attr of auth cookie to 'strict' Max Carrara
                   ` (4 more replies)
  0 siblings, 5 replies; 7+ messages in thread
From: Max Carrara @ 2023-03-15 16:26 UTC (permalink / raw)
  To: pve-devel

This series sets the `SameSite` attribute of authentication cookies
to `Strict` as per RFC 6265[1]. This prevents browsers from nagging;
for example, FireFox 102.8.0esr would complain in the following manner:

> Cookie “PVEAuthCookie” does not have a proper “SameSite” attribute 
> value. Soon, cookies without the “SameSite” attribute or with an
> invalid value will be treated as “Lax”. This means that the cookie
> will no longer be sent in third-party contexts. If your application
> depends on this cookie being available in such contexts, please add
> the “SameSite=None“ attribute to it. To know more about the
> “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Since setting `SameSite` to `Strict` enforces that the cookie be only
sent in a first-party context - so, only to the web UI and no other
site - it seemed like the best thing to choose. I'm not aware of the
cookie being used in any other contexts; if that's the case, I'll
gladly provide a v2.

The attribute is set wherever it makes sense; the only repo in which
it's not set would be 'pve-client', as that one's apparently not being
used at all (it wouldn't even build). Please let me know if I have
missed any spots.

[1] https://httpwg.org/http-extensions/draft-ietf-httpbis-rfc6265bis.html#name-the-samesite-attribute


proxmox-widget-toolkit:

Max Carrara (2):
  toolkit/utils: set SameSite attr of auth cookie to 'strict'
  toolkit/utils: fix whitespace

 src/Toolkit.js | 513 ++++++++++++++++++++++++++-----------------------
 src/Utils.js   |   6 +-
 2 files changed, 276 insertions(+), 243 deletions(-)


pve-http-server:

Max Carrara (1):
  formatter/bootstrap: set SameSite attr of auth cookie to 'strict'

 src/PVE/APIServer/Formatter.pm           | 2 +-
 src/PVE/APIServer/Formatter/Bootstrap.pm | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)


pve-apiclient:

Max Carrara (1):
  lwp: set SameSite attr of auth cookie to 'strict'

 PVE/APIClient/LWP.pm | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.39.2





^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2023-06-23  8:14 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-15 16:26 [pve-devel] [PATCH widget-toolkit/http-server/apiclient 0/4] Set SameSite=Strict on Auth Cookies Max Carrara
2023-03-15 16:26 ` [pve-devel] [PATCH proxmox-widget-toolkit 1/4] toolkit/utils: set SameSite attr of auth cookie to 'strict' Max Carrara
2023-03-15 16:26 ` [pve-devel] [PATCH proxmox-widget-toolkit 2/4] toolkit/utils: fix whitespace Max Carrara
2023-03-15 16:26 ` [pve-devel] [PATCH http-server 3/4] formatter/bootstrap: set SameSite attr of auth cookie to 'strict' Max Carrara
2023-03-15 16:26 ` [pve-devel] [PATCH apiclient 4/4] lwp: " Max Carrara
2023-06-06 15:17 ` [pve-devel] applied-series: [PATCH widget-toolkit/http-server/apiclient 0/4] Set SameSite=Strict on Auth Cookies Thomas Lamprecht
2023-06-23  8:14   ` Max Carrara

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal