1556151 - SessionCookies.jsm does not restore the SameSite flag of session cookies

Status: RESOLVED FIXED

(Firefox :: Session Restore, enhancement, P3)

Description

[Rob Wu [:robwu]]

SessionCookiesInternal.restore unconditionally uses SAMESITE_NONE as the sameSite flag. This is incorrect, the sameSite flag should have been saved at CookieStore.add and be restored later.

The effect of this is that after a session restore, session cookies could inadvertently be included in requests where they shouldn't have been included (when SameSite=Lax or SameSite=Strict).

Comment 1

[Release mgmt bot [:sylvestre / :calixte / :marco for bugbug]]

The priority flag is not set for this bug.
:mikedeboer, could you have a look please?

For more information, please visit auto_nag documentation.

Comment 2

[Mike de Boer [:mikedeboer]]

Sounds plausible to me, but I unfortunately don't have time to work on this right now. Please feel free to pick this up - I'd be more than happy to mentor!

Comment 3

[Dennis van der Schagt [:dennisschagt]]

Attachment: Bug 1556151 - SessionStore: Save and restore cookie.sameSite flag

Bug 1556151 - SessionStore: Save and restore cookie.sameSite flag

Comment 4

[Dennis van der Schagt [:dennisschagt]]

I just submitted a patch and added :mikedeboer as reviewer.

:mikedeboer, Could you assign this bug to me?

This is one of my first contributions to Firefox. Please let me know if there is anything I can improve on.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/922be4adb708
SessionStore: Save and restore cookie.sameSite flag r=mikedeboer

Comment 6

[Daniel Varga [:dvarga]]

https://hg.mozilla.org/mozilla-central/rev/922be4adb708

Comment 7

[Mike de Boer [:mikedeboer]]

Dennis, well done for (one of) your first contribution(s) to Firefox! I'm looking forward to many more in the future!