Support for SameSite cookies

SameSite cookies are already supported by Chrome and Firefox, but at the moment not enabled by default. When enabled (tested with Chrome 76 beta), the SAML authentication breaks. Namely, when the IdP uses the SAML HTTP-POST binding to send the SAML Response back to the SATOSA backend and SameSite cookies are enabled, the SATOSA cookie will not be included in the POST request and SATOSA will fail.

This is not an immediate problem, but it will become a problem when/if browsers turn on SameSite cookies by default.

Code Version

master

Expected Behavior

When SATOSA creates the state cookie, it should have SameSite set to None

Current Behavior

There is no support for SameSite. The change for SATOSA is trivial, but the problem is that the python http library also has to support SameSite cookies. SameSite cookie support has been added to the python 3.8 branch

Possible Solution

Wait for python 3.8 and then add support for SameSite cookies in state.py. In the meantime, for SATOSA deployments that are behind an HTTP reverse proxy, the problem can be mitigated by setting the cookie parameters in the HTTP reverse proxy.

For nginx the following directive does the trick:

proxy_cookie_path ~(/*) "$1; SameSite=None";

Steps to Reproduce

1. Download Chrome 76 beta
2. Go to chrome://flags
3. Enable “SameSite by default cookies”
4. Clear all cookies
5. Use SATOSA to authenticate to a SAML IdP (The domain of the IdP has to be different from the domain of the SATOSA instance)

References

• https://blog.chromium.org/2019/05/improving-privacy-and-security-on-web.html
• https://web.dev/samesite-cookies-explained/
• https://tools.ietf.org/html/draft-west-cookie-incrementalism-00
• https://github.com/GoogleChromeLabs/samesite-examples/blob/master/python.md

[andrewsali]

There is however a browser independent solution as recommended by Google and referenced in the Auth0 article. SATOSA needs to send 2 cookies, one SATOSA_STATE (with Samesite=None and Secure) and one SATOSA_STATE_LEGACY with the latter being sent with the current settings. Then SATOSA needs to check when parseing the cookie if SATOSA_STATE exists (should for new browsers), if not then try parsing SATOSA_STATE_LEGACY (which will make it work with old Safari, etc…).

I see the point with respect to Python 3.8, however I think this fix will become necessary as Chrome is such a dominant browser.

[c00kiemon5ter]

That actually sounds like a great solution. I will try to put something along those lines soon. Thanks for bringing this up 😉