Uploaded image for project: 'translate5'
  1. translate5
  2. TRANSLATE-2311

Cookie Security

XMLWordPrintable

    • Medium
    • Important for users which are using an own task administration: test if the integration works, if not the samesite cookie config in application.ini must be removed and this issue reopened!
    • Set the authentication cookie according to the latest security recommendations.

      Set the Cookie security in dependency of the ssl usage flag.

      COOKIE: ZFEXTENDED

      The cookie is missing Secure, HttpOnly and SameSite flag, make sure it does not store sensitive information.

      The HttpOnly cookie can not be used by us, since we need JS access to the session cookie.

          [TRANSLATE-2311] Cookie Security

          Thomas Lauria added a comment - - edited

          SameSite with "strict" prevents OpenID connect from working and prevents authToken logins generated via SessionController (See TS-710) from a different domain opened with window.open().

          SameSite with "Lax" allows authToken logins, but still prevents OpenID Connect.

          SameSite with "None" allows all, but needs HTTPS.

          Conclusion: We set the SameSite flag in dependency of the HTTPS state, and enable OpenID and authToken only if running with HTTPS.

          Thomas Lauria added a comment - - edited SameSite with "strict" prevents OpenID connect from working and prevents authToken logins generated via SessionController (See TS-710) from a different domain opened with window.open(). SameSite with "Lax" allows authToken logins, but still prevents OpenID Connect. SameSite with "None" allows all, but needs HTTPS. Conclusion: We set the SameSite flag in dependency of the HTTPS state, and enable OpenID and authToken only if running with HTTPS.

          Thomas Lauria added a comment -

          According to firefox:
          Das Cookie "zfExtended" wird in Zukunft bald abgelehnt werden, da es für das Attribut "SameSite" entweder "None" oder einen ungültigen Wert angibt, ohne das "secure"-Attribut zu verwenden. Weitere Informationen zum "SameSite"-Attribut finden Sie unter https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite.

          Thomas Lauria added a comment - According to firefox: Das Cookie "zfExtended" wird in Zukunft bald abgelehnt werden, da es für das Attribut "SameSite" entweder "None" oder einen ungültigen Wert angibt, ohne das "secure"-Attribut zu verwenden. Weitere Informationen zum "SameSite"-Attribut finden Sie unter https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite .

            tlauria Thomas Lauria
            tlauria Thomas Lauria
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: