60 lines
3.1 KiB
Plaintext
60 lines
3.1 KiB
Plaintext
==============================================================================
|
|
docs/output/12-samesite.txt
|
|
The Set-Cookie headers this application emits under four configurations, and what
|
|
SpecCookieJar - a model of RFC 6265bis 5.5 and 5.8.3 - does with them.
|
|
==============================================================================
|
|
|
|
## csrf.spa() defaults, session cookie left at same-site=lax
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=Lax
|
|
|
|
## session cookie set to same-site=none, secure=false
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=None
|
|
|
|
## crosssite profile: SameSite=None and Secure on both cookies
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/; Secure; SameSite=None
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; Secure; HttpOnly; SameSite=None
|
|
|
|
## crosssite profile with -DOMIT_SECURE=true
|
|
Set-Cookie: XSRF-TOKEN=<token>; Path=/; SameSite=None
|
|
Set-Cookie: JSESSIONID=<session>; Path=/; HttpOnly; SameSite=None
|
|
|
|
## The same headers, run through SpecCookieJar
|
|
{
|
|
"origin": "not trustworthy (plain http)",
|
|
"setCookieOutcomes": {
|
|
"JSESSIONID=s1; Path=/; HttpOnly; SameSite=Lax": "stored",
|
|
"JSESSIONID=s2; Path=/; HttpOnly; SameSite=None": "REJECTED JSESSIONID: SameSite=None and no Secure attribute - RFC 6265bis 5.5",
|
|
"JSESSIONID=s3; Path=/; Secure; HttpOnly; SameSite=None": "REJECTED JSESSIONID: SameSite=None with Secure, but the origin is not trustworthy so Secure is not honoured - RFC 6265bis 5.5",
|
|
"XSRF-TOKEN=t1; Path=/": "stored",
|
|
"XSRF-TOKEN=t2; Path=/; SameSite=None": "REJECTED XSRF-TOKEN: SameSite=None and no Secure attribute - RFC 6265bis 5.5",
|
|
"XSRF-TOKEN=t3; Path=/; Secure; SameSite=None": "REJECTED XSRF-TOKEN: SameSite=None with Secure, but the origin is not trustworthy so Secure is not honoured - RFC 6265bis 5.5"
|
|
},
|
|
"sentOnSameSiteRequest": "JSESSIONID=s1; XSRF-TOKEN=t1",
|
|
"sentOnCrossSiteTopLevelNavigation": "JSESSIONID=s1; XSRF-TOKEN=t1",
|
|
"sentOnCrossSiteFetch": "(no cookies sent)"
|
|
}
|
|
|
|
{
|
|
"origin": "trustworthy (https, or http://localhost)",
|
|
"setCookieOutcomes": {
|
|
"JSESSIONID=s1; Path=/; HttpOnly; SameSite=Lax": "stored",
|
|
"JSESSIONID=s2; Path=/; HttpOnly; SameSite=None": "REJECTED JSESSIONID: SameSite=None and no Secure attribute - RFC 6265bis 5.5",
|
|
"JSESSIONID=s3; Path=/; Secure; HttpOnly; SameSite=None": "stored",
|
|
"XSRF-TOKEN=t1; Path=/": "stored",
|
|
"XSRF-TOKEN=t2; Path=/; SameSite=None": "REJECTED XSRF-TOKEN: SameSite=None and no Secure attribute - RFC 6265bis 5.5",
|
|
"XSRF-TOKEN=t3; Path=/; Secure; SameSite=None": "stored"
|
|
},
|
|
"sentOnSameSiteRequest": "JSESSIONID=s3; XSRF-TOKEN=t3",
|
|
"sentOnCrossSiteTopLevelNavigation": "JSESSIONID=s3; XSRF-TOKEN=t3",
|
|
"sentOnCrossSiteFetch": "JSESSIONID=s3; XSRF-TOKEN=t3"
|
|
}
|
|
|
|
# Read the second block first: over a trustworthy origin, the only two of the six
|
|
# that reach a cross-site fetch are the two carrying Secure AND SameSite=None.
|
|
# Then read the first: over plain http, none do -
|
|
# which is why a cross-site SPA cannot be developed against http://127.0.0.1.
|
|
# (http://localhost itself is treated as trustworthy by current browsers; a bare IP
|
|
# is not.)
|