Closed
Bug 1456529
Opened 8 years ago
Closed 8 years ago
Support SameSite attribute on session cookies
Categories
(bugzilla.mozilla.org :: General, enhancement)
Tracking
()
RESOLVED
FIXED
People
(Reporter: psiinon, Assigned: dylan)
References
(Depends on 1 open bug)
Details
Attachments
(1 file)
Firefox 60 introduces support for the SameSite cookie attribute: https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/
This provides significant protection against CSRF vulnerabilities and so it should be applied to any session cookies.
Happy to help with any implementation / checking tasks :)
|
Assignee | |
Comment 1•8 years ago
|
||
Heh, added to CGI.pm on 2016-06-14: https://metacpan.org/changes/distribution/CGI#L56
This looks easy.
|
|
Assignee | |
Comment 2•8 years ago
|
||
I want SameSite=Lax right? Not SameSite=Strict because that would mean when clicking on a link that leads to bugzilla you'd not be logged in?
Flags: needinfo?(sbennetts)
|
Reporter | |
Comment 3•8 years ago
|
||
Thats right - 'lax' will allow the user to be logged in from normal links, so I think thats best for bmo.
Flags: needinfo?(sbennetts)
|
|
Assignee | |
Comment 4•8 years ago
|
||
|
|
Assignee | |
Updated•8 years ago
|
Assignee: nobody → dylan
|
|
Assignee | |
Updated•8 years ago
|
Status: NEW → RESOLVED
Closed: 8 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•