search

pulibrary / pul_library_drupal

Deprecated - Princeton University Library Core Site Drupal Codebase
https://library.princeton.edu/
GNU General Public License v2.0
3 stars 0 forks source link

Set the cookie SameSite directive to Strict #2034

Closed sandbergja closed 8 months ago

sandbergja commented 8 months ago

Success criteria

Rationale

This reduces the number of scenarios in which the cookie will be sent, providing better CSRF protection and reducing the size of the Cookies header in some cases. Part of https://github.com/pulibrary/dacs_handbook/issues/154

Drupal 7 Documentation

Tradeoff

If a user logs into the Library Website, navigates to a non-Princeton Web site (e.g. Outlook), and then clicks a link from that Web site back to the Library Web site, they will need to log in to the Library Web site again.

Further reading

I found this from Mozilla, this from Portswigger, and this blog post from Andrew Lock to be helpful in understanding this topic.

sandbergja commented 8 months ago

Closing in favor of https://github.com/pulibrary/princeton_ansible/issues/4585