appsembler / edx-platform

Appsembler Tahoe fork of Open edX. Branches: `main` for Juniper and `hawthorn/main` for Hawthorn.
https://appsembler.com/products/tahoe/
GNU Affero General Public License v3.0
13 stars 15 forks source link

Ensure samesite=none logged_in cookies are deleted #1336

Closed bryanlandia closed 1 year ago

bryanlandia commented 1 year ago

Change description

Fix an upstream issue with Open edX < Maple / Django < 3.2.7 causing samesite cookie deletion to fail.

Fixes ENG-53 Patch delete_logged_in_cookies to bypass Django < 3.2.7 (Maple+) delete_cookie. It relies on prefix of __SECURE to determine secure cookies, so we have to use set_cookie with an expired date. Note this will still work with Session cookie domain middleware. Adapted from https://discuss.overhang.io/t/logged-in-cookies-not-deleted-on-logout-over-https-not-reproducible-on-edx-org/1011/6

Type of change

Related issues

https://appsembler.atlassian.net/browse/ENG-53

Checklists

Development

Security

Code review

github-actions[bot] commented 1 year ago

Checking git merge conflicts against https://github.com/edx/edx-platform.git

Comparing with open-release/nutmeg.master
Benchmark conflicts with main 292
Current conflicts 293
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'open-release/nutmeg.master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
Comparing with master
Benchmark conflicts with main 300
Current conflicts 301
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
github-actions[bot] commented 1 year ago

Checking git merge conflicts against https://github.com/edx/edx-platform.git

Comparing with open-release/nutmeg.master
Benchmark conflicts with main 292
Current conflicts 293
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'open-release/nutmeg.master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
Comparing with master
Benchmark conflicts with main 300
Current conflicts 301
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
github-actions[bot] commented 1 year ago

Checking git merge conflicts against https://github.com/edx/edx-platform.git

Comparing with open-release/nutmeg.master
Benchmark conflicts with main 292
Current conflicts 293
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'open-release/nutmeg.master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
Comparing with master
Benchmark conflicts with main 300
Current conflicts 301
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
github-actions[bot] commented 1 year ago

Checking git merge conflicts against https://github.com/edx/edx-platform.git

Comparing with open-release/nutmeg.master
Benchmark conflicts with main 292
Current conflicts 293
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'open-release/nutmeg.master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
Comparing with master
Benchmark conflicts with main 300
Current conflicts 301
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
github-actions[bot] commented 1 year ago

Checking git merge conflicts against https://github.com/edx/edx-platform.git

Comparing with open-release/nutmeg.master
Benchmark conflicts with main 292
Current conflicts 293
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'open-release/nutmeg.master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
Comparing with master
Benchmark conflicts with main 300
Current conflicts 301
Summary Adds 1 new conflicts. How can we do better?
New conflicting files with 'master' ``` openedx/core/djangoapps/user_authn/cookies.py ```
bryanlandia commented 1 year ago

I have this cherrypicked to PSU's branch and it's working well.