[js-embedded-discovery] branch main updated: EDS-94 Missing SameSite Attribute on _saml_idp cookie

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository js-embedded-discovery.

View the commit online:
http://git.shibboleth.net/view/?p=js-embedded-discovery.git;a=commit;h=aad115ac38b43185c70af2881769761ac593e315

The following commit(s) were added to refs/heads/main by this push:
     new aad115a  EDS-94 Missing SameSite Attribute on _saml_idp cookie
aad115a is described below

commit aad115ac38b43185c70af2881769761ac593e315
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Feb 7 14:10:09 2024 +0000

    EDS-94 Missing SameSite Attribute on _saml_idp cookie
    
    https://shibboleth.atlassian.net/browse/EDS-94
    
    As per the case this case (from Colin Bontemps) this allows abitrary
    strings to appendsed to the cookies when we them.
    
    New installs get same site secure settings.
---
 src/javascript/idpselect.js        | 10 ++++++++--
 src/javascript/idpselect_config.js |  6 ++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/src/javascript/idpselect.js b/src/javascript/idpselect.js
index dbecbfc..a58cd0b 100644
--- a/src/javascript/idpselect.js
+++ b/src/javascript/idpselect.js
@@ -28,6 +28,7 @@ function IdPSelectUI() {
     var helpURL;
     var ie6Hack;
     var samlIdPCookieTTL;
+    var samlIdPCookieProps;
     var maxIdPCharsDropDown;
     var maxIdPCharsButton;
     var maxIdPCharsAltTxt;
@@ -40,6 +41,7 @@ function IdPSelectUI() {
 
     var autoFollowCookie;
     var autoFollowCookieTTLs;
+    var autoFollowCookieProps;
 
     //
     // The cookie contents
@@ -154,6 +156,7 @@ function IdPSelectUI() {
         helpURL = paramsSupplied.helpURL;
         ie6Hack = paramsSupplied.ie6Hack;
         samlIdPCookieTTL = paramsSupplied.samlIdPCookieTTL;
+        samlIdPCookieProps = paramsSupplied.samlIdPCookieProps;
         alwaysShow = paramsSupplied.alwaysShow;
         maxResults = paramsSupplied.maxResults;
         ignoreKeywords = paramsSupplied.ignoreKeywords;
@@ -193,6 +196,7 @@ function IdPSelectUI() {
 
         autoFollowCookie = paramsSupplied.autoFollowCookie;
         autoFollowCookieTTLs = paramsSupplied.autoFollowCookieTTLs;
+        autoFollowCookieProps = paramsSupplied.autoFollowCookieProps;
 
         var lang;
 
@@ -1433,7 +1437,8 @@ function IdPSelectUI() {
         } else {
             expireDate = new Date(0);
         }
-        document.cookie=autoFollowCookie + '=1;path=/;expires=' + expireDate.toUTCString();
+        document.cookie=autoFollowCookie + '=1;path=/;expires=' + expireDate.toUTCString() +
+        ((autoFollowCookieProps===null) ? '' : autoFollowCookieProps);
     }
 
     /**
@@ -1523,7 +1528,8 @@ function IdPSelectUI() {
         }
         
         document.cookie='_saml_idp' + '=' + cookieData.join('%20') + '; path = /' +
-            ((expireDate===null) ? '' : '; expires=' + expireDate.toUTCString());
+            ((expireDate===null) ? '' : '; expires=' + expireDate.toUTCString()) +
+            ((samlIdPCookieProps===null) ? '' : samlIdPCookieProps);
         
     };
     
diff --git a/src/javascript/idpselect_config.js b/src/javascript/idpselect_config.js
index 754e2c1..b68fce9 100644
--- a/src/javascript/idpselect_config.js
+++ b/src/javascript/idpselect_config.js
@@ -27,12 +27,14 @@ function IdPSelectUIParms(){
     this.hiddenIdPs = null;          // Array of entityIds to delete
     this.ignoreKeywords = false;     // Do we ignore the <mdui:Keywords/> when looking for candidates
     this.showListFirst = false;      // Do we start with a list of IdPs or just the dropdown
-    this.samlIdPCookieTTL = 730;     // in days
-    this.setFocusTextBox = true;     // Set to false to supress focus 
+    this.samlIdPCookieTTL = 730;     // in days, this cookie is used to offer previously chosen IDP as preferredIdP
+    this.samlIdPCookieProps = '; Secure; SameSite=Lax'; // If set to a custom string, the string is appended to the cookie value
+    this.setFocusTextBox = true;     // Set to false to supress focus
     this.testGUI = false;
 
     this.autoFollowCookie = null;  //  If you want auto-dispatch, set this to the cookie name to use
     this.autoFollowCookieTTLs = [ 1, 60, 270 ]; // Cookie life (in days).  Changing this requires changes to idp_select_languages
+    this.autoFollowCookieProps = '; Secure; SameSite=Lax';  // If set to a custom string, the string is appended to the cookie value
 
     //
     // Language support. 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.