Conversation
* https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site-00 * https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02#section-5.3.7 * https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/ * https://blog.chromium.org/2019/10/developers-get-ready-for-new.html Set to Lax instead of Strict to allow linking to allow linking to FreshRSS without having to log-in again
|
Assuming we use form-based login, with a cookie:
Thoughts? |
This reverts commit 32a2d51.
|
After thinking a bit, I believe that Lax would be safer for a x.1 release, and we can discuss the possibly upgrade to Strict for the next bigger release, e.g. 1.16.0 |
|
I don't have the motivation to think about it tonight… but it is important to have for the next 1.15.1? |
|
Lax should be quite safe, especially since it is becoming the default value anyway. |
|
Ok, I gave a thought about this. If I understand, in Strict mode, if any external site link to, let's say the configuration page, the user will have to log in again. If so, I'm not really for the Strict mode and I would stay with Lax. Besides this opinion, Lax looks safe indeed and I'm now inclined to merge this PR for the 1.15.1 ;) |
|
If I understand @Alkarex's summary correctly (don't have time to read the provided links atm) then strict would break functionality like the bookmarklet? |
|
@Frenzie That is correct, I did not think about it |
Follow-up of FreshRSS#2630 now that we have PHP 7.3+ (even PHP 8.1+). * The new syntax natively supports `samesite`, and also avoids the need of re-setting all parameters. * Use automatic path instead of own function `getCookieDir()`. Follow-up of FreshRSS#8446 * Sanitize lifetime of session cookies from PHP ini to avoid likely invalid/misunderstood values
Follow-up of #2630 now that we have PHP 7.3+ (even PHP 8.1+). * The new syntax natively supports `samesite`, and also avoids the need of re-setting all parameters. * Use automatic path instead of own function `getCookieDir()`. Follow-up of #8446 * Sanitize lifetime of session cookies from PHP ini to avoid likely invalid/misunderstood values
We can discuss whether it should be Lax or Strict