[server] Set JWT cookie on sign-in WEB-100 #17200
Conversation
|
started the job as gitpod-build-mp-server-jwt-session-2.1 because the annotations in the pull request description changed |
easyCZ
force-pushed
the
mp/server-jwt-session-2
branch
from
d87a326 to
45b858d
Compare
easyCZ
changed the title
easyCZ
force-pushed
the
mp/server-jwt-session-2
branch
2 times, most recently
from
4354107 to
cb1bd27
Compare
easyCZ
force-pushed
the
mp/server-jwt-session-2
branch
from
dcebc39 to
6f8ae73
Compare
| response.cookie(SessionHandlerProvider.getJWTCookieName(this.config.hostUrl), token, { | ||
| maxAge: this.config.session.maxAgeMs, | ||
| httpOnly: true, | ||
| sameSite: "lax", |
There was a problem hiding this comment.
Let's use strict cookies, please.
There was a problem hiding this comment.
This matches the current cookie setting which we issue for session cookie. (it actually also marks the cookie as "secure" which we don't do currently)
Do you know the exact implications of changing this to strict?
There was a problem hiding this comment.
A strict cookie means, that if the browser (already received the cookie) is redirected to a 3rd party, and then back to Gitpod, the cookie will not be sent. This is a typical scenario for redirect-based flows, where the 3rd party knows some sort of "returnTo" URL to redirect back, e.g. after asking user for consent.
Hmm, now having that said, it sounds like we'd break Git Integrations with that. There are (at least) two solutions available:
- using a state param and a nonce cookie for redirect-based flows, similar to what's now done for OIDC SSO. There we no longer rely on a session.
- use a trick to relax the cookie for the time of a web-flow cycle: Make Gitpod cookie "stricter" #16406
That's getting to complicating here, I guess.
So, not raising the bar here seems ok, but keep in mind that we need to make it strict eventually to improve the security posture.
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
|
/unhold |
roboquat
added
deployed: webapp
Description
On succesful sign-in, a JWT cookie is generated and stored in the client session.
Feature is behind a feature flag.
Related Issue(s)
How to test
_jwt_suffixRelease Notes
Documentation
Build Options:
Run the build with werft instead of GHA
Run Leeway with
--dont-testPublish Options
Installer Options
Add desired feature flags to the end of the line above, space separated
Preview Environment Options:
If enabled this will build
install/previewIf enabled this will create the environment on GCE infra
Valid options are
all,workspace,webapp,ide,jetbrains,vscode,ssh/hold