search

maykinmedia / mozilla-django-oidc-db

Database-backed settings for mozilla-django-oidc, with modified unique identifiers for users
MIT License
4 stars 0 forks source link

Ensure OIDC login works in combination with SameSite strict settings of open-api-framework #116

Closed alextreme closed 1 month ago

alextreme commented 1 month ago

open-api-framework issue, raised by @sergei-maertens 

SESSION_COOKIE_SAMESITE = config(
    "SESSION_COOKIE_SAMESITE",
    "Strict",
    help_text=(
        "The value of the SameSite flag on the session cookie. This flag prevents the "
        "cookie from being sent in cross-site requests thus preventing CSRF attacks and "
        "making some methods of stealing session cookie impossible."
    ),
)

This doesn't work well with Google OIDC (and likely Azure since someone else was running into similar issues). It needs to be set to "Lax". Note that this probably not a problem as soon as you are logged in to google, keycloak can then re-use the existing google session, but for the first login, shit breaks

Suggested workaround: set the session cookie to 'lax' during the oidc login-flow using a custom middleware in mozilla-django-oidc-db, and revert it back to 'strict' afterwards

sergei-maertens commented 1 month ago

Workaround being tested/applied here: https://github.com/GeneriekPublicatiePlatformWoo/registratie-component/pull/29

alextreme commented 1 month ago

@Coperh discussed with Sergei and please set the default to Lax for now, this should be sufficient for the AMS issue (as the complaint was that SameSite wasn't set)

joeribekker commented 1 month ago

All components that use the latest OAf will not work with OIDC due to this. Currently:

Apply workaround that Sergei mentioned.