From 824f910bfe39b8d789ca3edcfca44b66f603a81c Mon Sep 17 00:00:00 2001
From: Erik Michelson
Date: Thu, 27 Aug 2020 02:04:49 +0200
Subject: Add config option for cookie SameSite policy

Signed-off-by: Erik Michelson <github@erik.michelson.eu>
---
 lib/config/default.js     | 1 +
 lib/config/environment.js | 1 +
 lib/config/index.js       | 5 +++++
 lib/web/statusRouter.js   | 3 ++-
 4 files changed, 9 insertions(+), 1 deletion(-)

(limited to 'lib')

diff --git a/lib/config/default.js b/lib/config/default.js
index 9284882a..3d1a1367 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -27,6 +27,7 @@ module.exports = {
     upgradeInsecureRequests: 'auto',
     reportURI: undefined
   },
+  cookiePolicy: 'strict',
   protocolUseSSL: false,
   useCDN: false,
   allowAnonymous: true,
diff --git a/lib/config/environment.js b/lib/config/environment.js
index 2d76286f..cf9fb5a1 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -22,6 +22,7 @@ module.exports = {
     enable: toBooleanConfig(process.env.CMD_CSP_ENABLE),
     reportURI: process.env.CMD_CSP_REPORTURI
   },
+  cookiePolicy: process.env.CMD_COOKIE_POLICY,
   protocolUseSSL: toBooleanConfig(process.env.CMD_PROTOCOL_USESSL),
   allowOrigin: toArrayConfig(process.env.CMD_ALLOW_ORIGIN),
   useCDN: toBooleanConfig(process.env.CMD_USECDN),
diff --git a/lib/config/index.js b/lib/config/index.js
index ee4817b3..020dee13 100644
--- a/lib/config/index.js
+++ b/lib/config/index.js
@@ -51,6 +51,11 @@ if (['debug', 'verbose', 'info', 'warn', 'error'].includes(config.loglevel)) {
   logger.error('Selected loglevel %s doesn\'t exist, using default level \'debug\'. Available options: debug, verbose, info, warn, error', config.loglevel)
 }
 
+if (!['strict', 'lax', 'none'].includes(config.cookiePolicy)) {
+  logger.error('Cookie SameSite policy %s does not exist. Falling back to strict. Available values are: strict, lax, none.', config.cookiePolicy)
+  config.cookiePolicy = 'strict'
+}
+
 // load LDAP CA
 if (config.ldap.tlsca) {
   let ca = config.ldap.tlsca.split(',')
diff --git a/lib/web/statusRouter.js b/lib/web/statusRouter.js
index 025aafd4..febe2df3 100644
--- a/lib/web/statusRouter.js
+++ b/lib/web/statusRouter.js
@@ -97,7 +97,8 @@ statusRouter.get('/config', function (req, res) {
     version: config.fullversion,
     DROPBOX_APP_KEY: config.dropbox.appKey,
     allowedUploadMimeTypes: config.allowedUploadMimeTypes,
-    linkifyHeaderStyle: config.linkifyHeaderStyle
+    linkifyHeaderStyle: config.linkifyHeaderStyle,
+    cookiePolicy: config.cookiePolicy
   }
   res.set({
     'Cache-Control': 'private', // only cache by client
-- 
cgit v1.2.3