From c615fe2296b78d9b6d5fd0721a1c541551675200 Mon Sep 17 00:00:00 2001 From: Will Norris Date: Fri, 8 Dec 2023 10:19:13 -0800 Subject: [PATCH] client/web: add security attributes on session cookie Limit cookies to HTTP requests (not accessible from javascript). Set SameSite to "Lax", which is similar to "Strict" but allows for cookies to be included in requests that come from offsite links. This will be necessary when we link to the web client from the admin console. Updates #10261 Fixes tailscale/corp#16265 Signed-off-by: Will Norris --- client/web/web.go | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/client/web/web.go b/client/web/web.go index 24b0d6a18..24fd71c8b 100644 --- a/client/web/web.go +++ b/client/web/web.go @@ -494,11 +494,19 @@ func (s *Server) serveAPIAuthSessionNew(w http.ResponseWriter, r *http.Request) } // Set the cookie on browser. http.SetCookie(w, &http.Cookie{ - Name: sessionCookieName, - Value: session.ID, - Raw: session.ID, - Path: "/", - Expires: session.expires(), + Name: sessionCookieName, + Value: session.ID, + Raw: session.ID, + Path: "/", + HttpOnly: true, + SameSite: http.SameSiteStrictMode, + Expires: session.expires(), + // We can't set Secure to true because we serve over HTTP + // (but only on Tailscale IPs, hence over encrypted + // connections that a LAN-local attacker cannot sniff). + // In the future, we could support HTTPS requests using + // the full MagicDNS hostname, and could set this. + // Secure: true, }) }