Opened 6 years ago
Closed 6 years ago
#30250 closed Bug (duplicate)
Due to iOS Safari 12 issue, SameSite flag on session and CSRF cookies should NOT be Lax by default
Reported by: | Flávio Juvenal | Owned by: | nobody |
---|---|---|---|
Component: | Core (Other) | Version: | 2.1 |
Severity: | Normal | Keywords: | samesite, csrf, session, cookies |
Cc: | Maciej Olko | Triage Stage: | Someday/Maybe |
Has patch: | no | Needs documentation: | no |
Needs tests: | no | Patch needs improvement: | no |
Easy pickings: | no | UI/UX: | no |
Description (last modified by )
There's a iOS Safari 12 issue that prevents common flows (sequences of requests) to work properly if there's SameSite=lax
on cookies. This issue was confirmed by Daniel Bates, from Apple and it's still open.
Examples of broken flows:
- OpenIdConnect: https://community.auth0.com/t/authentication-broken-on-asp-net-core-and-safari-on-ios-12-mojave-take-2/19104
- Shopify app OAuth flow: https://www.calazan.com/django-21-samesite-cookie-issue-with-safari-12/
- Validating an email: https://bugs.webkit.org/show_bug.cgi?id=188165#c40
- SAML flow: https://github.com/IronCountySchoolDistrict/django-python3-saml/issues/1
Since Safari 12 is the current stable version and it's widely deployed on iOS devices, I believe the Django default for CSRF_COOKIE_SAMESITE
and SESSION_COOKIE_SAMESITE
should be None
, not Lax
. That's the most general solution and it's the one recommended by Microsoft to fix the similar issue on ASP.NET (they didn't change the default, though).
Core developers, could you please let me know if you agree with that change, so I can make a PR updating the defaults and the documentation?
I think both CSRF and Session cookies shouldn't have the SameSite flag because I've found many 403 Forbidden issues on both on Safari 12. If more steps to reproduce beyond the links above are necessary, please let me know.
---
Update:
In fact, a much simpler flow is broken on Safari 12 with the default "Lax" settings.
If the user comes from a cross-site redirection (like a tracker link from an email provider), Safari doesn't send samesite=lax cookies on the request. This causes multiple issues:
- User will not be logged in if
SESSION_COOKIE_SAMESITE = 'Lax'
. That behavior is only expected if'Strict'
. - User will not be able to make AJAX POST requests if
CSRF_COOKIE_SAMESITE = 'Lax'
, because JS code won't be able to read the CSRF cookie. - POSTs on other open tabs/windows will fail if
CSRF_COOKIE_SAMESITE = 'Lax'
, because Safari triggered a CSRF cookie update after the first request without cookies.
Those issues do not happen on Chrome.
Full example here: https://github.com/vintasoftware/safari-samesite-cookie-issue
Change History (9)
comment:1 by , 6 years ago
Description: | modified (diff) |
---|
comment:2 by , 6 years ago
Description: | modified (diff) |
---|
comment:3 by , 6 years ago
Description: | modified (diff) |
---|
comment:4 by , 6 years ago
Description: | modified (diff) |
---|
comment:5 by , 6 years ago
Component: | Uncategorized → Core (Other) |
---|---|
Easy pickings: | unset |
Triage Stage: | Unreviewed → Someday/Maybe |
comment:6 by , 6 years ago
Description: | modified (diff) |
---|
comment:7 by , 6 years ago
Thanks Tim, thread created on django-developers: https://groups.google.com/d/msg/django-developers/b_7XQYFaVeU/7M5KtGM2CAAJ
comment:8 by , 6 years ago
Cc: | added |
---|
Please raise the issue on the DevelopersMailingList as it gets more attention than this ticket tracker.