From 9e69d726e0e9fa7d09be6e616d2c6b6268030af5 Mon Sep 17 00:00:00 2001 From: Dominik Csapak Date: Mon, 7 Oct 2024 17:02:51 +0200 Subject: [PATCH] fix external linking to products by setting cookie SameSite attribute to lax We introduced the 'strict' setting when browsers warned about our cookies not having any SameSite setting [0]. While this works in general, it had an unforeseen side effect: When opening a link to the web UI of Proxmox projects, any existing cookie does not get sent on the initial page load due to coming from another origin. This then leads to the username and CSRF prevention token not being set in the index response. The UI code interprets this as the user being logged out (e.g. because the ticket is not valid) and clears the cookie, displaying the login window, even if the cookie's ticket value was still valid. The MDN reference[1] says that setting it to 'lax' is similar to 'strict', but sends the cookie when navigating *to* our origin even from other sites, which is what we want when linking from elsewhere. (This would have also been the default if we wouldn't have set any attribute). [0]: https://lore.proxmox.com/pve-devel/20230315162630.289768-1-m.carrara@proxmox.com/ [1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#SameSite_attribute Fixes: aec7e8d ("toolkit/utils: set SameSite attr of auth cookie to 'strict'") Signed-off-by: Dominik Csapak --- src/Utils.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Utils.js b/src/Utils.js index 7dd034a..b68c0f4 100644 --- a/src/Utils.js +++ b/src/Utils.js @@ -317,7 +317,7 @@ utilities: { // that way the cookie gets deleted after the browser window is closed if (data.ticket) { Proxmox.CSRFPreventionToken = data.CSRFPreventionToken; - Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, data.ticket, null, '/', null, true, "strict"); + Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, data.ticket, null, '/', null, true, "lax"); } if (data.token) { @@ -343,7 +343,7 @@ utilities: { return; } // ExtJS clear is basically the same, but browser may complain if any cookie isn't "secure" - Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, "", new Date(0), null, null, true, "strict"); + Ext.util.Cookies.set(Proxmox.Setup.auth_cookie_name, "", new Date(0), null, null, true, "lax"); window.localStorage.removeItem("ProxmoxUser"); },