From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 50D5F90B5B for ; Wed, 15 Mar 2023 17:27:07 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 31690C8D1 for ; Wed, 15 Mar 2023 17:26:37 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 15 Mar 2023 17:26:36 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 1F04841987 for ; Wed, 15 Mar 2023 17:26:36 +0100 (CET) From: Max Carrara To: pve-devel@lists.proxmox.com Date: Wed, 15 Mar 2023 17:26:27 +0100 Message-Id: <20230315162630.289768-2-m.carrara@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230315162630.289768-1-m.carrara@proxmox.com> References: <20230315162630.289768-1-m.carrara@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.035 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH proxmox-widget-toolkit 1/4] toolkit/utils: set SameSite attr of auth cookie to 'strict' X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Mar 2023 16:27:07 -0000 Overrides 'Ext.util.Cookies', optionally allowing the SameSite attribute of cookies to be defined. Using this override, the SameSite attribute of the auth cookie is now set to 'strict', prohibiting the cookie from being sent along in cross-site sub-requests or when the user navigates to a different site. Signed-off-by: Max Carrara --- src/Toolkit.js | 33 +++++++++++++++++++++++++++++++++ src/Utils.js | 4 ++-- 2 files changed, 35 insertions(+), 2 deletions(-) diff --git a/src/Toolkit.js b/src/Toolkit.js index 4314fb4..1cf8bc7 100644 --- a/src/Toolkit.js +++ b/src/Toolkit.js @@ -702,6 +702,39 @@ Ext.define('Proxmox.dd.DragDropManager', { }, }); +// make it possible to set the SameSite attribute on cookies +Ext.define('Proxmox.Cookies', { + override: 'Ext.util.Cookies', + + set: function(name, value, expires, path, domain, secure, samesite) { + let attrs = []; + + if (expires) { + attrs.push("expires=" + expires.toUTCString()); + } + + if (path === undefined) { // mimic original function's behaviour + attrs.push("path=/"); + } else if (path) { + attrs.push("path=" + path); + } + + if (domain) { + attrs.push("domain=" + domain); + } + + if (secure === true) { + attrs.push("secure"); + } + + if (samesite && ["lax", "none", "strict"].includes(samesite.toLowerCase())) { + attrs.push("samesite=" + samesite); + } + + document.cookie = name + "=" + escape(value) + "; " + attrs.join("; "); + }, +}); + // force alert boxes to be rendered with an Error Icon // since Ext.Msg is an object and not a prototype, we need to override it // after the framework has been initiated diff --git a/src/Utils.js b/src/Utils.js index c9c00a9..2343afd 100644 --- a/src/Utils.js +++ b/src/Utils.js @@ -306,7 +306,7 @@ utilities: { // that way the cookie gets deleted after the browser window is closed if (data.ticket) { Proxmox.CSRFPreventionToken = data.CSRFPreventionToken; - Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, data.ticket, null, '/', null, true); + Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, data.ticket, null, '/', null, true, "strict"); } if (data.token) { @@ -332,7 +332,7 @@ utilities: { return; } // ExtJS clear is basically the same, but browser may complain if any cookie isn't "secure" - Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, "", new Date(0), null, null, true); + Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, "", new Date(0), null, null, true, "strict"); window.localStorage.removeItem("ProxmoxUser"); }, -- 2.39.2