Closed mlilynolting closed 1 month ago
Attention: Patch coverage is 50.00000%
with 10 lines
in your changes missing coverage. Please review.
Project coverage is 73.91%. Comparing base (
80bdc97
) to head (06d499d
). Report is 3 commits behind head on develop.
@LizBaldo doesn't an unset flag evaluate to False? I thought that was the ? part of ${?FLAG}
@LizBaldo doesn't an unset flag evaluate to False? I thought that was the ? part of
${?FLAG}
I am not sure actually, that's why I am thinking it might be safer to set it, but if you know otherwise feel free to go ahead
No, the abundance of caution makes a ton of sense to me, thanks. I hadn't made a helmfile PR yet; just did: https://github.com/broadinstitute/terra-helmfile/pull/5741 (I had thought I'd be able to test it with the defaults but I was wrong)
Jira ticket: https://broadworkbench.atlassian.net/browse/IA-4997
Summary of changes
Can't test this locally or in a BEE, so here is a change which should be disabled everywhere by default.
NOTE: There are a bunch of nginx rewrites in the app helm charts here to add the Partitioned flag; for now I've commented them out and left the old logic in place. They ought not to be needed for me to test Galaxy under CHIPS.
Let's see what the Domain header does in Set-Cookie!
When the config flag IS_PROXY_COOKIE_PARTITIONED is set, Leo
setCookie
will respond with three Set-Cookie headers: one unscoped (will be blocked as a top-level third party cookie), one partitioned without a domain (will be scoped to the embedding domain, thus terra-ui), and one partitioned with a domain set to the proxy URL (might?? be scoped to the proxy domain and get past third-party protections on the new Galaxy tab!)Testing these changes
We'll need to check Galaxy, Jupyter, Rstudio, and AoU tools with the flag set. This should be possible by pointing a local terra-ui at dev, with the proxy cookie flag set in leo's
overrides.env
file.This is not intended as a final fix, just an attempt to understand whether the Domain attribute could possibly allow us to use CHIPS for now to get past our third-party cookie woes.
What to test
Who tested and where
jenkins retest
orjenkins multi-test
.