freeipa

#9749 add "SameSite" flag to ipa_session cookies
Closed: fixed by sumenon. Opened by ftrivino.

Closed: fixed
Reopen Issue

Request for enhancement

ipa_session cookie does not include "SameSite" flag. A customer complained about the error in scanning tool which reported this issue as CSRF.

Issue

Scanning tool detects this as vulnerability

Steps to Reproduce

  1. Log in IPA web UI by IPA user on Chrome
  2. Open Chrome development mode and see the ipa_session cookie
  3. The flag for "SameSite" is not present

Actual behavior

(what happens)
ipa_session cookie does not have "SameSite" flag

Expected behavior

(what do you expect to happen)
ipa_session cookie should include "SameSite" flag for CSRF prevention

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server

Metadata Update from @ftrivino:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-70229

Metadata Update from @dhanina:
- Issue assigned to dhanina

Metadata Update from @dhanina:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8336

master:

  • 36da55160a752e709cec377e52bccefb0c9f596c Enforce Same-Site cookie

ipa-4-8:

  • ed34c7adfcfb207be2def5416461ccdb0e853d19 Enforce Same-Site cookie

ipa-4-6:

  • 2a1768422350a899eb572ddc16363967e6b6d096 Enforce Same-Site cookie

ipa-4-13:

  • 3682f0a51f9af4ade3e52da255954f09dbe402a8 Enforce Same-Site cookie

ipa-4-12:

  • 1ac7af76d4d5ae67dfb35a1caf150fddba0dfb25 Enforce Same-Site cookie

ipa-4-9:

  • 34e487f231dbdda3032b3604a5b0947dd87b1156 Enforce Same-Site cookie

ipa-4-11:

  • 885d2e9e1a6cf2531b5a1572f79dee9f2dc2e2f6 Enforce Same-Site cookie

ipa-4-10:

  • 0fc607d5aedfca536d80bd6caa4bb631b89151bc Enforce Same-Site cookie

Metadata Update from @sumenon:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/8336
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.