Bug 54484 - UMC: make SameSite cookie attribute configurable
Summary: UMC: make SameSite cookie attribute configurable
Status: CLOSED FIXED
Alias: None
Product: UCS
Classification: Unclassified
Component: UMC (Generic)
Version: UCS 5.0
Hardware: Other Linux
: P5 normal
Target Milestone: UCS 5.0-1-errata
Assignee: Christian Castens
QA Contact: Florian Best
URL: https://git.knut.univention.de/univen...
Keywords:
Depends on:
Blocks:
 
Reported: 2022-02-23 14:32 CET by Florian Best
Modified: 2022-04-13 20:58 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Customer ID:
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Florian Best univentionstaff 2022-02-23 14:32:53 CET 
The SameSite cookie attribute should be set by UMC when sending cookies.
Especially for the session cookie.

We should either make it configurable to set this or hardcode it to a useful default.
Respected must be that we are doing request to different origins (ucs-sso.$host) but this is the other way round. I think we can make a strict default here and might have to make a unstrict default in simplesamlphp (see Bug #54483).
Comment 2 Christian Castens univentionstaff 2022-04-04 11:58:01 CEST 
Successful build
Package: univention-management-console
Version: 12.0.12-21A~5.0.0.202204041052
Branch: ucs_5.0-0
Scope: errata5.0-1

It is now possible to set the SameSite cookie attribute for UMC cookies via UCR variable umc/http/cookie/samesite
Comment 3 Florian Best univentionstaff 2022-04-04 15:48:13 CEST 
OK: setting of SameSite=None|Lax|Strict works.
Note: SameSite=None can only be set if "Secure" is also set - otherwise browsers drop the entire cookie:
`ucr set umc/http/enforce-secure-cookie=true umc/http/cookie/samesite=None`
OK: UCR variable description
OK: YAML
Comment 5 Florian Best univentionstaff 2022-04-13 20:58:47 CEST 
Chrome 80 treats cookies as SameSite=Lax by default if no SameSite attribute is specified, see https://www.chromestatus.com/feature/5088147346030592.