Bug 54484 – UMC: make SameSite cookie attribute configurable

Bug 54484 - UMC: make SameSite cookie attribute configurable


Summary:	UMC: make SameSite cookie attribute configurable

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	UMC (Generic)
Version:	UCS 5.0
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 5.0-1-errata
Assigned To:	Christian Castens
QA Contact:	Florian Best

URL:	https://git.knut.univention.de/univen...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2022-02-23 14:32 CET by Florian Best
Modified:	2022-04-13 20:58 CEST (History)
CC List:	1 user (show)

See Also:	54483 54405
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):	Security
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Florian Best

2022-02-23 14:32:53 CET

The SameSite cookie attribute should be set by UMC when sending cookies.
Especially for the session cookie.

We should either make it configurable to set this or hardcode it to a useful default.
Respected must be that we are doing request to different origins (ucs-sso.$host) but this is the other way round. I think we can make a strict default here and might have to make a unstrict default in simplesamlphp (see Bug #54483).

Comment 2 Christian Castens

2022-04-04 11:58:01 CEST

Successful build
Package: univention-management-console
Version: 12.0.12-21A~5.0.0.202204041052
Branch: ucs_5.0-0
Scope: errata5.0-1

It is now possible to set the SameSite cookie attribute for UMC cookies via UCR variable umc/http/cookie/samesite

Comment 3 Florian Best

2022-04-04 15:48:13 CEST

OK: setting of SameSite=None|Lax|Strict works.
Note: SameSite=None can only be set if "Secure" is also set - otherwise browsers drop the entire cookie:
`ucr set umc/http/enforce-secure-cookie=true umc/http/cookie/samesite=None`
OK: UCR variable description
OK: YAML

Comment 4 Erik Damrose

2022-04-06 17:31:11 CEST

<https://errata.software-univention.de/#/?erratum=5.0x283>

Comment 5 Florian Best

2022-04-13 20:58:47 CEST

Chrome 80 treats cookies as SameSite=Lax by default if no SameSite attribute is specified, see https://www.chromestatus.com/feature/5088147346030592.