set Secure cookie flags only on HTTPS requests #19309
Conversation
Previously, OIDC session cookies always included HttpOnly and Secure flags, causing authentication to fail in local development over HTTP. This change conditionally adds these security flags only when the request is made over a secure connection, enabling local HTTP development while maintaining security in production.
This change modifies several test cases in `test_oidc.py` to include the `isSecure` attribute in the mocked request objects. This ensures that the tests accurately simulate secure requests, which is essential for validating the behavior of OIDC session cookies under secure conditions.
…urity This update introduces two new test cases in `test_oidc.py` to verify that OIDC session cookies are set with the appropriate HttpOnly and Secure flags depending on whether the request is secure or not. The tests ensure that cookies are configured correctly for both secure and non-secure requests, enhancing the validation of cookie security in the OIDC flow.
|
yannisdia seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
|
This closes #19303 |
v1.141.0 introduces a breaking change in OIDC authentication in http with Webkit See issue: element-hq/synapse#19303 See PR: element-hq/synapse#19309
v1.141.0 introduces a breaking change in OIDC authentication in http with Webkit See issue: element-hq/synapse#19303 See PR: element-hq/synapse#19309
| # Here we have the names of the cookies, and the options we use to set them. | ||
| _SESSION_COOKIES = [ | ||
| (b"oidc_session", b"HttpOnly; Secure; SameSite=None"), | ||
| (b"oidc_session_no_samesite", b"HttpOnly; Secure"), |
There was a problem hiding this comment.
What browser are you experiencing this in? What version?
According to the MDN docs, this should work as-is:
SecureIndicates that the cookie is sent to the server only when a request is made with the https: scheme (except on localhost)
-- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#secure
And https://stackoverflow.com/questions/62307431/firefox-sends-secure-cookies-to-localhost/62717136#62717136 has a couple links to the browser issue trackers that also explain that this should work:
- https://bugzilla.mozilla.org/show_bug.cgi?id=1648993
- https://bugs.chromium.org/p/chromium/issues/detail?id=1056543
Additional point of reference:
HTTPS used to be necessary to locally set a cookie that is
Secure, orSameSite:none, or has the__Hostprefix. It is no longer the case.
4 participants
Previously, OIDC session cookies always included Secure flags, causing authentication to fail in local development over HTTP.
This change conditionally adds these security flags only when the request is made over a secure connection, enabling local HTTP development while maintaining security in production.
Pull Request Checklist
EventStoretoEventWorkerStore.".code blocks.