|
 |
493c9a |
From 7ef4ae72a8578475064eb66e3ed5703ccf6ee078 Mon Sep 17 00:00:00 2001
|
|
|
493c9a |
From: Ruediger Pluem <r.pluem@gmx.de>
|
|
|
493c9a |
Date: Thu, 30 Apr 2020 07:56:01 +0200
|
|
|
493c9a |
Subject: [PATCH] Set SameSite to None on test cookie
|
|
|
493c9a |
|
|
|
493c9a |
If the SameSite cookie attribute is to be set because
|
|
|
493c9a |
MellonCookieSameSite is configured and MELLON_DISABLE_SAMESITE not set
|
|
|
493c9a |
for this particular request set it to None for the test cookie.
|
|
|
493c9a |
This ensures that the test cookie with the static test content does not
|
|
|
493c9a |
get lost in the HTTP-POST binding request issued by the autosubmit form
|
|
|
493c9a |
returned by the IDP.
|
|
|
493c9a |
Addresses #20
|
|
|
493c9a |
|
|
|
493c9a |
* auth_mellon.h: Add AM_FORCE_SAMESITE_NONE_NOTE
|
|
|
493c9a |
|
|
|
493c9a |
* auth_mellon_handler.c (am_send_login_authn_request): Set request note
|
|
|
493c9a |
to set SameSite to None if appropriate.
|
|
|
493c9a |
|
|
|
493c9a |
* auth_mellon_cookie.c (am_cookie_params): Set SameSite to None if
|
|
|
493c9a |
requested via request note.
|
|
|
493c9a |
---
|
|
|
493c9a |
auth_mellon.h | 3 +++
|
|
|
493c9a |
auth_mellon_cookie.c | 6 +++++-
|
|
|
493c9a |
auth_mellon_handler.c | 5 +++++
|
|
|
493c9a |
3 files changed, 13 insertions(+), 1 deletion(-)
|
|
|
493c9a |
|
|
|
493c9a |
diff --git a/auth_mellon.h b/auth_mellon.h
|
|
|
493c9a |
index fd39b28..401ed9c 100644
|
|
|
493c9a |
--- a/auth_mellon.h
|
|
|
493c9a |
+++ b/auth_mellon.h
|
|
|
493c9a |
@@ -100,6 +100,9 @@ typedef enum {
|
|
|
493c9a |
/* Disable SameSite Environment Value */
|
|
|
493c9a |
#define AM_DISABLE_SAMESITE_ENV_VAR "MELLON_DISABLE_SAMESITE"
|
|
|
493c9a |
|
|
|
493c9a |
+/* Force setting SameSite to None */
|
|
|
493c9a |
+#define AM_FORCE_SAMESITE_NONE_NOTE "MELLON_FORCE_SAMESITE_NONE"
|
|
|
493c9a |
+
|
|
|
493c9a |
|
|
|
493c9a |
/* This is the length of the id we use (for session IDs and
|
|
|
493c9a |
* replaying POST data).
|
|
|
493c9a |
diff --git a/auth_mellon_cookie.c b/auth_mellon_cookie.c
|
|
|
493c9a |
index 55f77a5..6bff81e 100644
|
|
|
493c9a |
--- a/auth_mellon_cookie.c
|
|
|
493c9a |
+++ b/auth_mellon_cookie.c
|
|
|
493c9a |
@@ -78,7 +78,11 @@ static const char *am_cookie_params(request_rec *r)
|
|
|
493c9a |
}
|
|
|
493c9a |
|
|
|
493c9a |
if (env_var_value == NULL){
|
|
|
493c9a |
- if (cfg->cookie_samesite == am_samesite_lax) {
|
|
|
493c9a |
+ if ((cfg->cookie_samesite != am_samesite_default) &&
|
|
|
493c9a |
+ (apr_table_get(r->notes, AM_FORCE_SAMESITE_NONE_NOTE) != NULL)) {
|
|
|
493c9a |
+ cookie_samesite = "; SameSite=None";
|
|
|
493c9a |
+ }
|
|
|
493c9a |
+ else if (cfg->cookie_samesite == am_samesite_lax) {
|
|
|
493c9a |
cookie_samesite = "; SameSite=Lax";
|
|
|
493c9a |
} else if (cfg->cookie_samesite == am_samesite_strict) {
|
|
|
493c9a |
cookie_samesite = "; SameSite=Strict";
|
|
|
493c9a |
diff --git a/auth_mellon_handler.c b/auth_mellon_handler.c
|
|
|
493c9a |
index 395ee1d..40c9bcd 100644
|
|
|
493c9a |
--- a/auth_mellon_handler.c
|
|
|
493c9a |
+++ b/auth_mellon_handler.c
|
|
|
493c9a |
@@ -3261,8 +3261,13 @@ static int am_send_login_authn_request(request_rec *r, const char *idp,
|
|
|
493c9a |
/* Add cookie for cookie test. We know that we should have
|
|
|
493c9a |
* a valid cookie when we return from the IdP after SP-initiated
|
|
|
493c9a |
* login.
|
|
|
493c9a |
+ * Ensure that SameSite is set to None for this cookie if SameSite
|
|
|
493c9a |
+ * is allowed to be set as the cookie otherwise gets lost on
|
|
|
493c9a |
+ * HTTP-POST binding messages.
|
|
|
493c9a |
*/
|
|
|
493c9a |
+ apr_table_setn(r->notes, AM_FORCE_SAMESITE_NONE_NOTE, "1");
|
|
|
493c9a |
am_cookie_set(r, "cookietest");
|
|
|
493c9a |
+ apr_table_unset(r->notes, AM_FORCE_SAMESITE_NONE_NOTE);
|
|
|
493c9a |
|
|
|
493c9a |
server = am_get_lasso_server(r);
|
|
|
493c9a |
if(server == NULL) {
|
|
|
493c9a |
--
|
|
|
493c9a |
2.26.2
|
|
|
493c9a |
|