search

dnnsoftware / Dnn.Platform

DNN (formerly DotNetNuke) is the leading open source web content management platform (CMS) in the Microsoft ecosystem.
https://dnncommunity.org/
MIT License
1.01k stars 745 forks source link

[Enhancement]: Set SameSite and Secure property for authentication cookie #6039

Open Mostafa-Moafi opened 1 month ago

Mostafa-Moafi commented 1 month ago

Is there an existing issue for this?

Description of problem

  1. Defining SAMESITE to ensure that cookies are not sent to a third-party site or address. The value of this tag must be defined as "Strict".
  2. Definition of the SECURE tag to ensure that the cookie is transmitted through a secure communication path and that it cannot eavesdrop (the SECURE tag should be activated after activating the HTTPS protocol).

Description of solution

For the secure enabled, I think we should check SSL enabled in DNN and update the cookie when logging user. for set SamaSite to Stric, we should just update the authentication cookie

Description of alternatives considered

No response

Anything else?

No response

Do you be plan to contribute code for this enhancement?

Would you be interested in sponsoring this enhancement?

Code of Conduct