allow samesite in cookies #4224

samuelcolvin · 2019-10-18T14:02:21Z

What do these changes do?

Allow samesite to be allowed in cookeis, see also:

Are there changes in behavior for the user?

no, just new samesite=None keyword argument to set_cookie()

Related issue number

Checklist

I think the code is well written
Unit tests for the changes exist
Documentation reflects the changes
If you provide code modification, please add yourself to CONTRIBUTORS.txt
- The format is <Name> <Surname>.
- Please keep alphabetical order, the file is sorted by names.
Add a new news fragment into the CHANGES folder
- name it <issue_id>.<type> for example (588.bugfix)
- if you don't have an issue_id change it to the pr id after creating the pr
- ensure type is one of the following:
  - .feature: Signifying a new feature.
  - .bugfix: Signifying a bug fix.
  - .doc: Signifying a documentation improvement.
  - .removal: Signifying a deprecation or removal of public API.
  - .misc: A ticket has been closed, but it is not of interest to users.
- Make sure to use full sentences with correct case and punctuation, for example: "Fix issue with non-ascii contents in doctest text files."

asvetlov · 2019-10-18T14:05:08Z

Hmm.
I'm biased; should we monkey-patch Python<3.8 or restrict the feature to Python 3.8+ only?

Guys, what are your opinions?

samuelcolvin · 2019-10-18T14:11:29Z

I'm happy with either, just let me know and I'll update the PR.

samuelcolvin · 2019-10-18T14:14:22Z

But given that chrome showing a warning for any cookie not including SameSite, I imagine many people will want this fairly soon - restricting it to python >= 3.8 will cause headaches for lots of people.

codecov-io · 2019-10-18T14:22:55Z

Codecov Report

Merging #4224 into master will decrease coverage by 0.01%.
The diff coverage is 83.33%.

@@            Coverage Diff             @@
##           master    #4224      +/-   ##
==========================================
- Coverage   97.58%   97.57%   -0.02%     
==========================================
  Files          43       43              
  Lines        8853     8857       +4     
  Branches     1385     1387       +2     
==========================================
+ Hits         8639     8642       +3     
  Misses         92       92              
- Partials      122      123       +1

Impacted Files	Coverage Δ
aiohttp/web_response.py	`97.48% <83.33%> (-0.21%)`	⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1ea69bc...4bf1573. Read the comment docs.

asvetlov

Ok, let's do monkey-patching if the lack of SameSite is considered as a security issue.

Please mention the argument in docs (http://docs.aiohttp.org/en/stable/web_reference.html#aiohttp.web.StreamResponse.set_cookie)

Use 3.7 for .. versionadded::

asvetlov · 2019-10-18T14:23:25Z

aiohttp/web_response.py

@@ -42,6 +42,12 @@
    BaseClass = collections.abc.MutableMapping


+if 'samesite' not in Morsel._reserved:  # type: ignore


Use helpers.PY_38 check here instead if Morsel._reserved lookup.
It makes the intention explicitly clear and allows dropping the patch after dropping Python 3.7 support.

asvetlov

Please add :param: samesite section

samuelcolvin · 2019-10-22T10:40:16Z

Done, with versionadded, docs look like:

is that okay?

asvetlov · 2019-10-25T10:41:41Z

docs/web_reference.rst

@@ -702,6 +703,14 @@ StreamResponse
                          specification the cookie
                          conforms. (Optional, *version=1* by default)

+      .. versionadded:: 3.7


Please move the directive inside :param: block, see web.Response zlib_executor_size for inspiration.

asvetlov · 2019-10-28T18:24:17Z

@samuelcolvin ping

samuelcolvin · 2019-10-29T12:46:51Z

done, sorry for delay.

(cherry picked from commit 1220613) Co-authored-by: Samuel Colvin <s@muelcolvin.com>

samuelcolvin · 2019-10-29T13:31:49Z

👌

(cherry picked from commit 1220613) Co-authored-by: Samuel Colvin <s@muelcolvin.com>

AndreiPashkin · 2020-01-23T10:56:59Z

@asvetlov, I wonder - is this going to be released anytime soon?

bitnom · 2020-03-10T06:28:25Z

Very important security consideration. Should consider a new release just to get this feature out the door imo. I'm tempted to install from master. Any commits in master I should be afraid of at this point?

vishim · 2020-03-16T08:40:32Z

@asvetlov - Is there anything blocking the 3.7 release? Chrome has already started rolling out the samesite update to a selected population.

asvetlov · 2020-06-19T06:41:50Z

This pull request has been mentioned on aio-libs. There might be relevant details there:

https://aio-libs.discourse.group/t/patch-samesite-cookies-to-minor-version/111/1

This fixes py-yarl in pkgsrc being too new for py-aiohttp. 3.7.0 (2020-10-24) ================== Features -------- - Response headers are now prepared prior to running ``on_response_prepare`` hooks, directly before headers are sent to the client. `#1958 <https://github.com/aio-libs/aiohttp/issues/1958>`_ - Add a ``quote_cookie`` option to ``CookieJar``, a way to skip quotation wrapping of cookies containing special characters. `#2571 <https://github.com/aio-libs/aiohttp/issues/2571>`_ - Call ``AccessLogger.log`` with the current exception available from ``sys.exc_info()``. `#3557 <https://github.com/aio-libs/aiohttp/issues/3557>`_ - `web.UrlDispatcher.add_routes` and `web.Application.add_routes` return a list of registered `AbstractRoute` instances. `AbstractRouteDef.register` (and all subclasses) return a list of registered resources registered resource. `#3866 <https://github.com/aio-libs/aiohttp/issues/3866>`_ - Added properties of default ClientSession params to ClientSession class so it is available for introspection `#3882 <https://github.com/aio-libs/aiohttp/issues/3882>`_ - Don't cancel web handler on peer disconnection, raise `OSError` on reading/writing instead. `#4080 <https://github.com/aio-libs/aiohttp/issues/4080>`_ - Implement BaseRequest.get_extra_info() to access a protocol transports' extra info. `#4189 <https://github.com/aio-libs/aiohttp/issues/4189>`_ - Added `ClientSession.timeout` property. `#4191 <https://github.com/aio-libs/aiohttp/issues/4191>`_ - allow use of SameSite in cookies. `#4224 <https://github.com/aio-libs/aiohttp/issues/4224>`_ - Use ``loop.sendfile()`` instead of custom implementation if available. `#4269 <https://github.com/aio-libs/aiohttp/issues/4269>`_ - Apply SO_REUSEADDR to test server's socket. `#4393 <https://github.com/aio-libs/aiohttp/issues/4393>`_ - Use .raw_host instead of slower .host in client API `#4402 <https://github.com/aio-libs/aiohttp/issues/4402>`_ - Allow configuring the buffer size of input stream by passing ``read_bufsize`` argument. `#4453 <https://github.com/aio-libs/aiohttp/issues/4453>`_ - Pass tests on Python 3.8 for Windows. `#4513 <https://github.com/aio-libs/aiohttp/issues/4513>`_ - Add `method` and `url` attributes to `TraceRequestChunkSentParams` and `TraceResponseChunkReceivedParams`. `#4674 <https://github.com/aio-libs/aiohttp/issues/4674>`_ - Add ClientResponse.ok property for checking status code under 400. `#4711 <https://github.com/aio-libs/aiohttp/issues/4711>`_ - Don't ceil timeouts that are smaller than 5 seconds. `#4850 <https://github.com/aio-libs/aiohttp/issues/4850>`_ - TCPSite now listens by default on all interfaces instead of just IPv4 when `None` is passed in as the host. `#4894 <https://github.com/aio-libs/aiohttp/issues/4894>`_ - Bump ``http_parser`` to 2.9.4 `#5070 <https://github.com/aio-libs/aiohttp/issues/5070>`_ Bugfixes -------- - Fix keepalive connections not being closed in time `#3296 <https://github.com/aio-libs/aiohttp/issues/3296>`_ - Fix failed websocket handshake leaving connection hanging. `#3380 <https://github.com/aio-libs/aiohttp/issues/3380>`_ - Fix tasks cancellation order on exit. The run_app task needs to be cancelled first for cleanup hooks to run with all tasks intact. `#3805 <https://github.com/aio-libs/aiohttp/issues/3805>`_ - Don't start heartbeat until _writer is set `#4062 <https://github.com/aio-libs/aiohttp/issues/4062>`_ - Fix handling of multipart file uploads without a content type. `#4089 <https://github.com/aio-libs/aiohttp/issues/4089>`_ - Preserve view handler function attributes across middlewares `#4174 <https://github.com/aio-libs/aiohttp/issues/4174>`_ - Fix the string representation of ``ServerDisconnectedError``. `#4175 <https://github.com/aio-libs/aiohttp/issues/4175>`_ - Raising RuntimeError when trying to get encoding from not read body `#4214 <https://github.com/aio-libs/aiohttp/issues/4214>`_ - Remove warning messages from noop. `#4282 <https://github.com/aio-libs/aiohttp/issues/4282>`_ - Raise ClientPayloadError if FormData re-processed. `#4345 <https://github.com/aio-libs/aiohttp/issues/4345>`_ - Fix a warning about unfinished task in ``web_protocol.py`` `#4408 <https://github.com/aio-libs/aiohttp/issues/4408>`_ - Fixed 'deflate' compression. According to RFC 2616 now. `#4506 <https://github.com/aio-libs/aiohttp/issues/4506>`_ - Fixed OverflowError on platforms with 32-bit time_t `#4515 <https://github.com/aio-libs/aiohttp/issues/4515>`_ - Fixed request.body_exists returns wrong value for methods without body. `#4528 <https://github.com/aio-libs/aiohttp/issues/4528>`_ - Fix connecting to link-local IPv6 addresses. `#4554 <https://github.com/aio-libs/aiohttp/issues/4554>`_ - Fix a problem with connection waiters that are never awaited. `#4562 <https://github.com/aio-libs/aiohttp/issues/4562>`_ - Always make sure transport is not closing before reuse a connection. Reuse a protocol based on keepalive in headers is unreliable. For example, uWSGI will not support keepalive even it serves a HTTP 1.1 request, except explicitly configure uWSGI with a ``--http-keepalive`` option. Servers designed like uWSGI could cause aiohttp intermittently raise a ConnectionResetException when the protocol poll runs out and some protocol is reused. `#4587 <https://github.com/aio-libs/aiohttp/issues/4587>`_ - Handle the last CRLF correctly even if it is received via separate TCP segment. `#4630 <https://github.com/aio-libs/aiohttp/issues/4630>`_ - Fix the register_resource function to validate route name before splitting it so that route name can include python keywords. `#4691 <https://github.com/aio-libs/aiohttp/issues/4691>`_ - Improve typing annotations for ``web.Request``, ``aiohttp.ClientResponse`` and ``multipart`` module. `#4736 <https://github.com/aio-libs/aiohttp/issues/4736>`_ - Fix resolver task is not awaited when connector is cancelled `#4795 <https://github.com/aio-libs/aiohttp/issues/4795>`_ - Fix a bug "Aiohttp doesn't return any error on invalid request methods" `#4798 <https://github.com/aio-libs/aiohttp/issues/4798>`_ - Fix HEAD requests for static content. `#4809 <https://github.com/aio-libs/aiohttp/issues/4809>`_ - Fix incorrect size calculation for memoryview `#4890 <https://github.com/aio-libs/aiohttp/issues/4890>`_ - Add HTTPMove to _all__. `#4897 <https://github.com/aio-libs/aiohttp/issues/4897>`_ - Fixed the type annotations in the ``tracing`` module. `#4912 <https://github.com/aio-libs/aiohttp/issues/4912>`_ - Fix typing for multipart ``__aiter__``. `#4931 <https://github.com/aio-libs/aiohttp/issues/4931>`_ - Fix for race condition on connections in BaseConnector that leads to exceeding the connection limit. `#4936 <https://github.com/aio-libs/aiohttp/issues/4936>`_ - Add forced UTF-8 encoding for ``application/rdap+json`` responses. `#4938 <https://github.com/aio-libs/aiohttp/issues/4938>`_ - Fix inconsistency between Python and C http request parsers in parsing pct-encoded URL. `#4972 <https://github.com/aio-libs/aiohttp/issues/4972>`_ - Fix connection closing issue in HEAD request. `#5012 <https://github.com/aio-libs/aiohttp/issues/5012>`_ - Fix type hint on BaseRunner.addresses (from ``List[str]`` to ``List[Any]``) `#5086 <https://github.com/aio-libs/aiohttp/issues/5086>`_ - Make `web.run_app()` more responsive to Ctrl+C on Windows for Python < 3.8. It slightly increases CPU load as a side effect. `#5098 <https://github.com/aio-libs/aiohttp/issues/5098>`_ Improved Documentation ---------------------- - Fix example code in client quick-start `#3376 <https://github.com/aio-libs/aiohttp/issues/3376>`_ - Updated the docs so there is no contradiction in ``ttl_dns_cache`` default value `#3512 <https://github.com/aio-libs/aiohttp/issues/3512>`_ - Add 'Deploy with SSL' to docs. `#4201 <https://github.com/aio-libs/aiohttp/issues/4201>`_ - Change typing of the secure argument on StreamResponse.set_cookie from ``Optional[str]`` to ``Optional[bool]`` `#4204 <https://github.com/aio-libs/aiohttp/issues/4204>`_ - Changes ``ttl_dns_cache`` type from int to Optional[int]. `#4270 <https://github.com/aio-libs/aiohttp/issues/4270>`_ - Simplify README hello word example and add a documentation page for people coming from requests. `#4272 <https://github.com/aio-libs/aiohttp/issues/4272>`_ - Improve some code examples in the documentation involving websockets and starting a simple HTTP site with an AppRunner. `#4285 <https://github.com/aio-libs/aiohttp/issues/4285>`_ - Fix typo in code example in Multipart docs `#4312 <https://github.com/aio-libs/aiohttp/issues/4312>`_ - Fix code example in Multipart section. `#4314 <https://github.com/aio-libs/aiohttp/issues/4314>`_ - Update contributing guide so new contributors read the most recent version of that guide. Update command used to create test coverage reporting. `#4810 <https://github.com/aio-libs/aiohttp/issues/4810>`_ - Spelling: Change "canonize" to "canonicalize". `#4986 <https://github.com/aio-libs/aiohttp/issues/4986>`_ - Add ``aiohttp-sse-client`` library to third party usage list. `#5084 <https://github.com/aio-libs/aiohttp/issues/5084>`_ Misc ---- - `#2856 <https://github.com/aio-libs/aiohttp/issues/2856>`_, `#4218 <https://github.com/aio-libs/aiohttp/issues/4218>`_, `#4250 <https://github.com/aio-libs/aiohttp/issues/4250>`_

allow samesite in cookies

8c2a7cd

samuelcolvin requested review from asvetlov and webknjaz as code owners October 18, 2019 14:02

psf-chronographer bot added the bot:chronographer:provided There is a change note present in this PR label Oct 18, 2019

samuelcolvin mentioned this pull request Oct 18, 2019

Any interest in adding the 'samesite' flag to cookies? aio-libs/aiohttp-session#376

Closed

add change

4bb159a

fix import

2b5657a

asvetlov requested changes Oct 18, 2019

View reviewed changes

use PY_38

1a5414b

asvetlov requested changes Oct 18, 2019

View reviewed changes

add info on samesite to docs

7c0912b

asvetlov requested changes Oct 25, 2019

View reviewed changes

samuelcolvin added 2 commits October 29, 2019 12:40

Merge branch 'master' into cookie-samesite

33b3c47

fix documentation

4bf1573

asvetlov approved these changes Oct 29, 2019

View reviewed changes

asvetlov merged commit 1220613 into aio-libs:master Oct 29, 2019

asvetlov pushed a commit that referenced this pull request Oct 29, 2019

[3.7] allow samesite in cookies (#4224)

6030515

(cherry picked from commit 1220613) Co-authored-by: Samuel Colvin <s@muelcolvin.com>

samuelcolvin deleted the cookie-samesite branch October 29, 2019 13:31

asvetlov added a commit that referenced this pull request Oct 29, 2019

[3.7] allow samesite in cookies (#4224) (#4303)

b903fdb

(cherry picked from commit 1220613) Co-authored-by: Samuel Colvin <s@muelcolvin.com>

ewjoachim mentioned this pull request Mar 17, 2020

CSRF vulnerability python/blurb_it#114

Closed

alandtse mentioned this pull request Aug 6, 2020

An exception of type CookieError occurred. Arguments: ("Attempt to set a reserved key 'SameSite'",) alandtse/alexa_media_player#862

Closed

asvetlov pushed a commit that referenced this pull request Oct 16, 2020

allow samesite in cookies (#4224)

c7afab3

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

allow samesite in cookies #4224

allow samesite in cookies #4224

samuelcolvin commented Oct 18, 2019 •

edited

Loading

asvetlov commented Oct 18, 2019

samuelcolvin commented Oct 18, 2019

samuelcolvin commented Oct 18, 2019

codecov-io commented Oct 18, 2019 •

edited

Loading

asvetlov left a comment

asvetlov Oct 18, 2019 •

edited

Loading

asvetlov left a comment

samuelcolvin commented Oct 22, 2019

asvetlov Oct 25, 2019

asvetlov commented Oct 28, 2019

samuelcolvin commented Oct 29, 2019

samuelcolvin commented Oct 29, 2019

AndreiPashkin commented Jan 23, 2020

bitnom commented Mar 10, 2020

vishim commented Mar 16, 2020 •

edited

Loading

asvetlov commented Jun 19, 2020

		@@ -42,6 +42,12 @@
		BaseClass = collections.abc.MutableMapping


		if 'samesite' not in Morsel._reserved: # type: ignore

allow samesite in cookies #4224

allow samesite in cookies #4224

Conversation

samuelcolvin commented Oct 18, 2019 • edited Loading

What do these changes do?

Are there changes in behavior for the user?

Related issue number

Checklist

asvetlov commented Oct 18, 2019

samuelcolvin commented Oct 18, 2019

samuelcolvin commented Oct 18, 2019

codecov-io commented Oct 18, 2019 • edited Loading

Codecov Report

asvetlov left a comment

Choose a reason for hiding this comment

asvetlov Oct 18, 2019 • edited Loading

Choose a reason for hiding this comment

asvetlov left a comment

Choose a reason for hiding this comment

samuelcolvin commented Oct 22, 2019

asvetlov Oct 25, 2019

Choose a reason for hiding this comment

asvetlov commented Oct 28, 2019

samuelcolvin commented Oct 29, 2019

samuelcolvin commented Oct 29, 2019

AndreiPashkin commented Jan 23, 2020

bitnom commented Mar 10, 2020

vishim commented Mar 16, 2020 • edited Loading

asvetlov commented Jun 19, 2020

samuelcolvin commented Oct 18, 2019 •

edited

Loading

codecov-io commented Oct 18, 2019 •

edited

Loading

asvetlov Oct 18, 2019 •

edited

Loading

vishim commented Mar 16, 2020 •

edited

Loading