Task #2591: Hardening Cookies Flags (#2580)

Author: julhoang

config/settings.py

@@ -135,6 +135,7 @@
 
 AUTH_USER_MODEL = "users.User"
 CSRF_COOKIE_HTTPONLY = True
+CSRF_COOKIE_SAMESITE = "Lax"
 # See https://docs.djangoproject.com/en/4.2/ref/settings/#csrf-trusted-origins
 csrf_trusted_origins = env.list(
     "CSRF_TRUSTED_ORIGINS", default=["http://0.0.0.0", "http://localhost"]
@@ -257,6 +258,10 @@
 # Increase default cookie age from 2 to 12 weeks
 SESSION_COOKIE_AGE = 60 * 60 * 24 * 7 * 12
 
+# Not "Strict": the social auth providers redirect back cross-site, and that
+# request must still carry the session cookie for the callback to resolve.
+SESSION_COOKIE_SAMESITE = "Lax"
+
 # Internationalization
 # https://docs.djangoproject.com/en/1.10/topics/i18n/
 
@@ -500,6 +505,8 @@
         "HTTP_X_FORWARDED_PROTO",
         ACCOUNT_DEFAULT_HTTP_PROTOCOL,
     )
+    SESSION_COOKIE_SECURE = True
+    CSRF_COOKIE_SECURE = True
 
 # Admin banner configuration
 ENV_NAME = env("ENVIRONMENT_NAME", default="Unknown Environment")
@@ -635,7 +642,7 @@
 
 CORS_ALLOW_ALL_ORIGINS = True
 CORS_ALLOW_CREDENTIALS = True
-SESSION_COOKIE_HTTPONLY = False
+SESSION_COOKIE_HTTPONLY = True
 
 CORS_ALLOW_METHODS = (
     "DELETE",

templates/users/profile.html

@@ -153,18 +153,11 @@ <h3>{% trans 'Delete Account' %}</h3>
 
   {% include "modal.html" %}
 
-  <script>
-    document.body.addEventListener('htmx:configRequest', function(event) {
-      /* only set CSRF token if config-sessionid cookie exists.
-      we don't really need this check while this functionality is limited to this
-      page, but I'm adding it anyway in case we move this in the future so we don't
-      overlook it. */
-      const hasSessionId = document.cookie.split(';').some(function(cookie) {
-        return cookie.trim().startsWith('config-sessionid=');
-      });
-      if (hasSessionId) {
+  {% if request.user.is_authenticated %}
+    <script>
+      document.body.addEventListener('htmx:configRequest', function(event) {
         event.detail.headers['X-CSRFToken'] = '{{ csrf_token }}';
-      }
-    });
-  </script>
+      });
+    </script>
+  {% endif %}
 {% endblock %}