SATOSA
SATOSA copied to clipboard
feat: cookie parameters in proxy configuration
This PR fixes https://github.com/IdentityPython/SATOSA/issues/344 introducing the following paramenters to be optionally handled in the proxy global configuration.
Secure
Now can be disabled via COOKIE_SECURE: no
in proxy_conf.yaml.
Default: True
that's only for dev purpose!
HttpOnly
To avoid cross-site scripting (XSS) attacks, cookies set with the HttpOnly directive are inaccessible to the JavaScript Document.cookie API. For example, session cookies don't need to be accessed by JavaScript and should therefore be set with the HttpOnly flag.
Default: True
parameter name eg: COOKIE_HTTPONLY: no
Domain, COOKIE_DOMAIN
Max-Age, COOKIE_MAX_AGE
it come also with some minor code linting and f-strings, few things.
All Submissions:
- [x] Have you checked to ensure there aren't other open Pull Requests for the same update/change?
- [x] Have you added an explanation of what problem you are trying to solve with this PR?
- [x] Have you added information on what your changes do and why you chose this as your solution?
- [ ] Have you written new tests for your changes?
- [x] Does your submission pass tests?
- [x] This project follows PEP8 style guide. Have you run your code against the 'flake8' linter?
It seems that here we have a collision https://github.com/IdentityPython/SATOSA/blob/1def9986e5c32baa5f95be835cf5843d9f9ab5d8/src/satosa/frontends/saml2.py#L558
anyway, with my PR I tested in the user-agent debugger and it seems that SATOSA cookie respects the global configuration parameter, instead of the frontend ones.
I think that we should have to decide if keep cookie paramenters in the plugins or move them in the global configuration and refactor/cleanup/reduce all those hardcodings
@peppelinux we will be merging this PR.
The SimpleCookie
created by the frontend is a separate one, it has a different purpose and should not conflict the cookie that the proxy is using to store state.