Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Session management enhancements #1894

Merged
merged 26 commits into from
Jun 10, 2024
Merged

Session management enhancements #1894

merged 26 commits into from
Jun 10, 2024

Conversation

holgerkoser
Copy link
Member

@holgerkoser holgerkoser commented May 29, 2024 •
edited by petersutter
Loading

What this PR does / why we need it:

  1. Added __Host- prefix to all cookie names.
  2. Always include a random value into the state parameter during the authorization flow.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Added [host-prefix](https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes#host-prefix) to all cookie names.
In order to mitigate Cross-Site Request Forgery (CSRF) attacks a random value is now part of the `state` parameter during the OIDC authorization code flow.
The local Vite dev server now starts on HTTPS at `https://localhost:8443` instead of `http://localhost:8080`. Run `yarn setup` to generate a server certificate and add the CA to the macOS keychain.

@gardener-robot gardener-robot added needs/review Needs review size/m Size of pull request is medium (see gardener-robot robot/bots/size.py) labels May 29, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 29, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels May 29, 2024
@gardener-robot gardener-robot added size/l Size of pull request is large (see gardener-robot robot/bots/size.py) needs/second-opinion Needs second review by someone else and removed size/m Size of pull request is medium (see gardener-robot robot/bots/size.py) labels May 30, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels May 30, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 30, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label May 30, 2024
@holgerkoser
do not exit in vite config
4464832
@holgerkoser
Merge branch 'enh/session-management' of github.com:gardener/dashboar…
bff0ef7 
…d into enh/session-management

* 'enh/session-management' of github.com:gardener/dashboard:
  Update dependency vuetify to v3.6.8 (#1895)
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 3, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 3, 2024
@grolu grolu added the area/security Security related label Jun 3, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 3, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 3, 2024
@holgerkoser holgerkoser requested a review from petersutter June 3, 2024 10:53
@gardener-robot-ci-3 gardener-robot-ci-3 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 3, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Jun 7, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 7, 2024
@gardener gardener deleted a comment from petersutter Jun 7, 2024
@holgerkoser holgerkoser requested a review from petersutter June 7, 2024 14:51
@gardener-robot-ci-1 gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 7, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 10, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 10, 2024
@gardener-robot-ci-1 gardener-robot-ci-1 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 10, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 10, 2024
petersutter
petersutter approved these changes Jun 10, 2024
View reviewed changes
Copy link
Member

@petersutter petersutter left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@gardener-robot gardener-robot added reviewed/lgtm Has approval for merging and removed needs/review Needs review needs/second-opinion Needs second review by someone else labels Jun 10, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Jun 10, 2024
grolu
grolu approved these changes Jun 10, 2024
View reviewed changes
Copy link
Contributor

@grolu grolu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would recommend to ad a breaking developer release note to inform about the changed URL and maybe also the requirement to generate ssl certificates (optional)
Otherwise /lgtm

@grolu grolu added the area/ipcei IPCEI (Important Project of Common European Interest) label Jun 10, 2024
@holgerkoser holgerkoser merged commit 3f534f1 into master Jun 10, 2024
8 checks passed
@holgerkoser holgerkoser deleted the enh/session-management branch June 10, 2024 19:50
@gardener-robot gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Jun 10, 2024
petersutter added a commit that referenced this pull request Jul 16, 2024
@petersutter
drop unused functions
a634bfd 
the functions got unused with PR #1894
petersutter added a commit that referenced this pull request Jul 18, 2024
@petersutter @holgerkoser
Refactor Project Services and Routes (#1946)
f85457c 
* extract to cost object composable

* rename legacy project service to namespace

* add new projects route, drop from/to mapping

* Use new projects route. Drop from/to mapping code

* Improved project deletion handling

* minor improvements

* PR feedback I

* add additional tests

* drop unused functions

the functions got unused with PR #1894

---------

Co-authored-by: Holger Koser <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@petersutter petersutter petersutter approved these changes

@grolu grolu grolu approved these changes

Assignees
No one assigned
Labels
area/ipcei IPCEI (Important Project of Common European Interest) area/security Security related needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) reviewed/lgtm Has approval for merging reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) size/l Size of pull request is large (see gardener-robot robot/bots/size.py) status/closed Issue is closed (either delivered or triaged)
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@holgerkoser @petersutter @grolu @gardener-robot-ci-1 @gardener-robot-ci-2 @gardener-robot-ci-3 @gardener-robot