Werk #11492: Auth cookies: Specify SameSite attribute to improve cookie security

Komponente GUI
Titel Auth cookies: Specify SameSite attribute to improve cookie security
Datum 11.09.2020
Checkmk-Editon Checkmk Raw (CRE)
Checkmk-Version 2.0.0i1
Level Kleine Änderung
Klasse Sicherheitsfix
Kompatibilität Kompatibel - benötigt kein manuelles Eingreifen

The authentication cookies of the Checkmk GUI (auth_[site]) previously relied on the browsers default behaviour regarding the same site policy. This resulted in a) an inconsistent cookie handling across the different browsers and b) allow some sort of Cross-site request forgery (CSRF) attacks.

With this change we explicitly set the "SameSite=Lax" setting for all authentication cookies created by logins after updating Checkmk.

For more information about this HTTP cookie setting have a look at https://web.dev/samesite-cookies-explained/.

Zur Liste aller Werks