1461630 - Support SameSite cookie attribute on sessionid

Status: RESOLVED FIXED

(Webtools Graveyard :: Pontoon, enhancement, P2)

Description

[Simon Bennetts [:psiinon]]

Firefox 60 introduces support for the SameSite cookie attribute: https://blog.mozilla.org/security/2018/04/24/same-site-cookies-in-firefox-60/
This provides significant protection against CSRF vulnerabilities and so it should be applied to the sessionid cookie.
It looks like its been added to Django https://code.djangoproject.com/ticket/27863 but the fix doesnt appear the be in the latest release.
I'm guessing we'll need to wait until theres a new Django release and then migrate to it before we can add SameSite support?

Comment 1

[Axel Hecht [:Pike]]

If the fix isn't back-ported to django 1.11.x, using this will require an update from python2 to python3, with all the jazz that comes with it.

Comment 2

[Simon Bennetts [:psiinon]]

We have a few other services on django 1.11.x - I'll look into how difficult it might be to back-port the fix.

Comment 3

[Simon Bennetts [:psiinon]]

Unfortunately 1.11 is only receiving data loss and security fixes: https://code.djangoproject.com/ticket/29409

Comment 4

[Jarek Śmiejczak [:jotes]]

:Pike, :mathjazz

From what I see, that's a small feature that can be implemented as a middleware, with the plan to remove this when Python3 will land in Pontoon. If that's okay for you I can take a stab.

Comment 5

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/pontoon/pull/964

Comment 6

[Matjaz Horvat [:mathjazz]]

Please go ahead. :))

Comment 7

[Simon Bennetts [:psiinon]]

Sounds like a good plan to me :)

Comment 8

[Matjaz Horvat [:mathjazz]]

:psiinon, could you review the patch at https://github.com/mozilla/pontoon/pull/964?

It might be useful for other services on django 1.11.x, too.

Comment 9

[Simon Bennetts [:psiinon]]

Looking at it right now.
I was thinking the same thing re other services :)

Comment 10

[[github robot]]

Commit pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/3cc5146fa19d651e172bec6ad7f55d8a002ffec6
Bug 1461630 - Set SameSite flag for session and csrf cookies. (#964)

Comment 11

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/pontoon/pull/966

Comment 12

[[github robot]]

Commit pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/340559fe8ffe40703aee0d1891215bb97fdf3e07
Fix bug 1461630: Update django-cookies-samesite to 0.1.2 (#966)

And fix the order of dependencies in requirements.txt.

Comment 13

[GitHub Bugzilla PR Linker]

Attachment: Link to GitHub pull-request: https://github.com/mozilla/pontoon/pull/968

Comment 14

[[github robot]]

Commit pushed to master at https://github.com/mozilla/pontoon

https://github.com/mozilla/pontoon/commit/914fb53382196b6363bcd7b3b8fa227f12ca7228
Bug 1461630 - Change SameSite attribute to "lax". (#968)

Otherwise we get "IndexError: list index out of range" error on log in.