In order to add additional security to none standard browsers we should explicitly set the SameSite cookie value[1][2] in apereo cas. It seems mod_auth_cas has a setting for this so it should be fairly trivial
[1]https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[2]https://web.dev/samesite-cookies-explained/#explicitly-state-cookie-usage-with-the-samesite-attribute
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| P:idp::client::http:site: add support for same site cookie | operations/puppet | production | +11 -0 |
The patch to support the setting is not yet in the released or packaged versions of libapache2-mod-auth-cas, but if it works for us, I can reach out to the maintainer to cherrypick the patch
I've built an updated mod_cas package with SameSite cookie support for buster-wikimedia (not imported yet to apt.wikimedia.org), will run some tests next week.
I have created a package with SameSite Cookie support and Secure Cookie Support. I have tested this on https://idp-test-login.wmcloud.org/ and every thing seems to work fine. I will add this to apt and create the necessary puppet glue
Mentioned in SAL (#wikimedia-operations) [2021-06-02T11:01:39Z] <jbond> upload libapache2-mod-auth-cas_1.2-1+wmf11u1_amd64.deb - #T264605
Mentioned in SAL (#wikimedia-operations) [2021-06-02T11:04:54Z] <jbond> upload libapache2-mod-auth-cas_1.2-1 for buster and stretch - #T264605
Mentioned in SAL (#wikimedia-operations) [2021-06-02T11:08:33Z] <jbond> update mod_auth_cas T264605
Change 697730 had a related patch set uploaded (by Jbond; author: John Bond):
[operations/puppet@production] P:idp::client::http:site: add support for same site cookie
Change 697730 merged by Jbond:
[operations/puppet@production] P:idp::client::http:site: add support for same site cookie