From 824f910bfe39b8d789ca3edcfca44b66f603a81c Mon Sep 17 00:00:00 2001 From: Erik Michelson Date: Thu, 27 Aug 2020 02:04:49 +0200 Subject: Add config option for cookie SameSite policy Signed-off-by: Erik Michelson --- lib/config/default.js | 1 + lib/config/environment.js | 1 + lib/config/index.js | 5 +++++ lib/web/statusRouter.js | 3 ++- 4 files changed, 9 insertions(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/config/default.js b/lib/config/default.js index 9284882a..3d1a1367 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -27,6 +27,7 @@ module.exports = { upgradeInsecureRequests: 'auto', reportURI: undefined }, + cookiePolicy: 'strict', protocolUseSSL: false, useCDN: false, allowAnonymous: true, diff --git a/lib/config/environment.js b/lib/config/environment.js index 2d76286f..cf9fb5a1 100644 --- a/lib/config/environment.js +++ b/lib/config/environment.js @@ -22,6 +22,7 @@ module.exports = { enable: toBooleanConfig(process.env.CMD_CSP_ENABLE), reportURI: process.env.CMD_CSP_REPORTURI }, + cookiePolicy: process.env.CMD_COOKIE_POLICY, protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL), allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN), useCDN: toBooleanConfig(process.env.CMD_USECDN), diff --git a/lib/config/index.js b/lib/config/index.js index ee4817b3..020dee13 100644 --- a/lib/config/index.js +++ b/lib/config/index.js @@ -51,6 +51,11 @@ if (['debug', 'verbose', 'info', 'warn', 'error'].includes(config.loglevel)) { logger.error('Selected loglevel %s doesn\'t exist, using default level \'debug\'. Available options: debug, verbose, info, warn, error', config.loglevel) } +if (!['strict', 'lax', 'none'].includes(config.cookiePolicy)) { + logger.error('Cookie SameSite policy %s does not exist. Falling back to strict. Available values are: strict, lax, none.', config.cookiePolicy) + config.cookiePolicy = 'strict' +} + // load LDAP CA if (config.ldap.tlsca) { let ca = config.ldap.tlsca.split(',') diff --git a/lib/web/statusRouter.js b/lib/web/statusRouter.js index 025aafd4..febe2df3 100644 --- a/lib/web/statusRouter.js +++ b/lib/web/statusRouter.js @@ -97,7 +97,8 @@ statusRouter.get('/config', function (req, res) { version: config.fullversion, DROPBOX_APP_KEY: config.dropbox.appKey, allowedUploadMimeTypes: config.allowedUploadMimeTypes, - linkifyHeaderStyle: config.linkifyHeaderStyle + linkifyHeaderStyle: config.linkifyHeaderStyle, + cookiePolicy: config.cookiePolicy } res.set({ 'Cache-Control': 'private', // only cache by client -- cgit v1.3.1 From 387e6682757d32b9d9e9b7e3d443143a39ce2184 Mon Sep 17 00:00:00 2001 From: Erik Michelson Date: Thu, 27 Aug 2020 09:05:17 +0200 Subject: Changed default policy from 'strict' to 'lax' due to the reasons mentioned in 3d1fab05 Signed-off-by: Erik Michelson --- lib/config/default.js | 2 +- lib/config/index.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/config/default.js b/lib/config/default.js index 3d1a1367..38bb164b 100644 --- a/lib/config/default.js +++ b/lib/config/default.js @@ -27,7 +27,7 @@ module.exports = { upgradeInsecureRequests: 'auto', reportURI: undefined }, - cookiePolicy: 'strict', + cookiePolicy: 'lax', protocolUseSSL: false, useCDN: false, allowAnonymous: true, diff --git a/lib/config/index.js b/lib/config/index.js index 020dee13..203b9ef9 100644 --- a/lib/config/index.js +++ b/lib/config/index.js @@ -53,7 +53,7 @@ if (['debug', 'verbose', 'info', 'warn', 'error'].includes(config.loglevel)) { if (!['strict', 'lax', 'none'].includes(config.cookiePolicy)) { logger.error('Cookie SameSite policy %s does not exist. Falling back to strict. Available values are: strict, lax, none.', config.cookiePolicy) - config.cookiePolicy = 'strict' + config.cookiePolicy = 'lax' } // load LDAP CA -- cgit v1.3.1 From 4ece86f0efa1f8f3e4dab0abf810800a045ce632 Mon Sep 17 00:00:00 2001 From: Erik Michelson Date: Tue, 8 Sep 2020 09:58:15 +0200 Subject: Update documentation and messages to new default value Signed-off-by: Erik Michelson --- docs/configuration.md | 2 +- lib/config/index.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/docs/configuration.md b/docs/configuration.md index 2b3ccad1..af4f26ce 100644 --- a/docs/configuration.md +++ b/docs/configuration.md @@ -81,7 +81,7 @@ these are rarely used for various reasons. | `csp` | | `{"enable": true, "directives": {"scriptSrc": "trustworthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": true}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. Some defaults are added to the configured values so that the application doesn't break. To disable this behaviour, set `addDefaults` to `false`. Further, if `usecdn` is on, some CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `useSSL` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. | | | `CMD_CSP_ENABLE` | **`true`** or `false` | whether to enable Content Security Policy (directives cannot be configured with environment variables) | | | `CMD_CSP_REPORTURI` | **`undefined`**, `https://.report-uri.com/r/d/csp/enforce` | Allows to add a URL for CSP reports in case of violations | -| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`strict`**, `lax` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor | +| `cookiePolicy` | `CMD_COOKIE_POLICY` | **`lax`**, `strict` or `none` | Set a SameSite policy whether cookies are send from cross-origin. Be careful: setting a SameSite value of none without https breaks the editor | ## Privacy and External Requests diff --git a/lib/config/index.js b/lib/config/index.js index 203b9ef9..b5461a8d 100644 --- a/lib/config/index.js +++ b/lib/config/index.js @@ -52,7 +52,7 @@ if (['debug', 'verbose', 'info', 'warn', 'error'].includes(config.loglevel)) { } if (!['strict', 'lax', 'none'].includes(config.cookiePolicy)) { - logger.error('Cookie SameSite policy %s does not exist. Falling back to strict. Available values are: strict, lax, none.', config.cookiePolicy) + logger.error('Cookie SameSite policy %s does not exist. Falling back to lax. Available values are: strict, lax, none.', config.cookiePolicy) config.cookiePolicy = 'lax' } -- cgit v1.3.1