Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set oauth cookie to secure=True when using same-site=none #648

Merged
merged 1 commit into from
Jan 10, 2024
Merged

Set oauth cookie to secure=True when using same-site=none #648

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion backend/chainlit/server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,8 +318,9 @@ async def oauth_login(provider_id: str, request: Request):
url=f"{provider.authorize_url}?{params}",
)
samesite = os.environ.get("CHAINLIT_COOKIE_SAMESITE", "lax") # type: Any
secure = samesite.lower() == 'none'
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

both none and strict should be secure and only lax should be secure false?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@willydouhard this code change only sets secure=True when none but i can easily update it if you'd like. I'm not sure of other people's use cases, but it could cause issues on localhost since it's http.

From GPT4:
For each SameSite option, here's what the Secure attribute should be set to:

  • SameSite=Strict: The Secure attribute can be set to true to ensure the cookie is only sent over HTTPS, but it is not required to be true because the cookie is not sent in cross-site requests. It can be false if the site is not using HTTPS, but using HTTPS is highly recommended for security.
  • SameSite=Lax: Similar to SameSite=Strict, the Secure attribute can be set to true to ensure the cookie is only sent over HTTPS, but it is not strictly necessary. However, setting it to true is a best practice for enhanced security. It can be false if the site is not using HTTPS, but again, using HTTPS is highly recommended.
  • SameSite=None: The Secure attribute must be set to true. This is required because SameSite=None allows the cookie to be sent in cross-site requests, and without the Secure attribute being true, the cookie would be vulnerable to interception over an unencrypted connection (HTTP).

response.set_cookie(
"oauth_state", random, httponly=True, samesite=samesite, max_age=3 * 60
"oauth_state", random, httponly=True, samesite=samesite, secure=secure, max_age=3 * 60
)
return response

Expand Down