SATOSA icon indicating copy to clipboard operation
SATOSA copied to clipboard

feat: cookie parameters in proxy configuration

Open peppelinux opened this issue 3 years ago • 2 comments

This PR fixes https://github.com/IdentityPython/SATOSA/issues/344 introducing the following paramenters to be optionally handled in the proxy global configuration.

Secure Now can be disabled via COOKIE_SECURE: no in proxy_conf.yaml. Default: True that's only for dev purpose!

HttpOnly To avoid cross-site scripting (XSS) attacks, cookies set with the HttpOnly directive are inaccessible to the JavaScript Document.cookie API. For example, session cookies don't need to be accessed by JavaScript and should therefore be set with the HttpOnly flag. Default: True parameter name eg: COOKIE_HTTPONLY: no

Domain, COOKIE_DOMAIN Max-Age, COOKIE_MAX_AGE

it come also with some minor code linting and f-strings, few things.

All Submissions:

  • [x] Have you checked to ensure there aren't other open Pull Requests for the same update/change?
  • [x] Have you added an explanation of what problem you are trying to solve with this PR?
  • [x] Have you added information on what your changes do and why you chose this as your solution?
  • [ ] Have you written new tests for your changes?
  • [x] Does your submission pass tests?
  • [x] This project follows PEP8 style guide. Have you run your code against the 'flake8' linter?

peppelinux avatar Mar 30 '21 17:03 peppelinux

It seems that here we have a collision https://github.com/IdentityPython/SATOSA/blob/1def9986e5c32baa5f95be835cf5843d9f9ab5d8/src/satosa/frontends/saml2.py#L558

anyway, with my PR I tested in the user-agent debugger and it seems that SATOSA cookie respects the global configuration parameter, instead of the frontend ones.

I think that we should have to decide if keep cookie paramenters in the plugins or move them in the global configuration and refactor/cleanup/reduce all those hardcodings

peppelinux avatar Mar 31 '21 08:03 peppelinux

@peppelinux we will be merging this PR.

The SimpleCookie created by the frontend is a separate one, it has a different purpose and should not conflict the cookie that the proxy is using to store state.

c00kiemon5ter avatar Apr 20 '21 12:04 c00kiemon5ter