search

rwf2 / cookie-rs

HTTP cookie parsing and cookie jar management for Rust.
https://docs.rs/cookie
Apache License 2.0
312 stars 119 forks source link

Set Removal Cookies SameSite to Lax #215

Closed genusistimelord closed 1 year ago

genusistimelord commented 1 year ago

The issue is Removal cookies don't get a Same Site setting which browsers are starting to Require Or presetting them as Lax. Inserting the Same site as Lax will prevent the Browser from displaying Warning messages and maybe Error messages later based on the action the browser take.

SergioBenitez commented 1 year ago

The treatment of cookies without a SameSite attribute is to place them inside of a "default" enforcement domain which browsers may treat differently to lax, though they should be equivalent after some arbitrarily chosen time. Irrespective of this, the latest draft RFC does not raise any concerns about removing cookies with or without SameSite attributes, and I wouldn't expect browsers to trigger a warning on cookies not containing a SameSite attribute if they have an expiration date in the past. There's no point in doing so: the cookie will never be sent anywhere, so it can't possibly pose a security threat.

Do you have any evidence to indicate that browsers do or will do otherwise?

genusistimelord commented 1 year ago

I would agree with you here But here is one from firefox. image

image2 even if its a old Cookie it still checks them. which is something I would not expect either.

Edit: So we either need to set it to Lax or SameSite=None with secure set to true. which seems to be what they are focusing on.

SergioBenitez commented 1 year ago

That feels like an issue for web browsers, not one that we should paper over here. The goal of this library is to be foundational and correct, not opinionated. For this reason, we don't arbitrarily set SameSite attributes, or any other attributes, for any cookies in this library, and I don't think we should automatically set them for removal cookies either, but this library liberally and conveniently allows setting them yourself. Should our position on that change, we can revisit this issue then. Until then, I'm closing this out.

Note: If you're using a web framework that uses this library, I would advocate that you raise an issue there. Web frameworks can be more opinionated. Rocket sets SameSite attributes automatically, for example. If it's not doing so for removal cookies, that sounds like an opportunity for improvement.