master/synapse
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Update oidc_session_no_samesite cookie to be Secure (#19079)

Browse Source
This commit is contained in:
Kieran Lane 2025-10-21 13:35:55 +01:00 committed by GitHub
parent 418c9f3fe5
commit 2f65b9e001
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/19079.bugfix Normal file
View File

@ -0,0 +1 @@
Fix the `oidc_session_no_samesite` cookie to have the `Secure` attribute, so the only difference between it and the paired `oidc_session` cookie, is the configuration of the `SameSite` attribute as described in the comments / cookie names. Contributed by @kieranlane.

2
synapse/handlers/oidc.py
View File

@ -96,7 +96,7 @@ logger = logging.getLogger(__name__)
# Here we have the names of the cookies, and the options we use to set them.
_SESSION_COOKIES = [
(b"oidc_session", b"HttpOnly; Secure; SameSite=None"),
(b"oidc_session_no_samesite", b"HttpOnly"),
(b"oidc_session_no_samesite", b"HttpOnly; Secure"),
]