Avoid cross origin forgery by using same-site cookie (backport #2948) #2958
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?s=60&v=4){kind=small}
Only allow access to the session cookie from the same site and not for third parties. This avoids CSRF attacks like like e.g. [BREACH](http://breachattack.com/). For more details please take a look at http://www.sjoerdlangkemper.nl/2016/04/14/preventing-csrf-with-samesite-cookie-attribute/ (cherry picked from commit d65c7a3)
(cherry picked from commit d0b8867) # Conflicts: # CHANGELOG.md
Codecov Report
@@ Coverage Diff @@
## gsa-21.04 #2958 +/- ##
==========================================
Coverage 53.84% 53.84%
==========================================
Files 1075 1075
Lines 26250 26250
Branches 7506 7506
==========================================
Hits 14133 14133
Misses 11000 11000
Partials 1117 1117
Continue to review full report at Codecov.
|
bjoernricks
approved these changes
Jun 3, 2021
cfi-gb
reviewed
Jun 7, 2021
| @@ -21,7 +22,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). | |||
| - Fixed missing name for CVE results on result detailspage [#2892](https://github.com/greenbone/gsa/pull/2892) | |||
| - Fixed setting secret key in RADIUS dialog [#2891](https://github.com/greenbone/gsa/pull/2891) | |||
| - Fixed setting result UUID in notes dialog [#2889](https://github.com/greenbone/gsa/pull/2889) | |||
|
|
|||
| - Fixed setting whether to include related resources for new permissions [#2931](https://github.com/greenbone/gsa/pull/2891) | |||
There was a problem hiding this comment.
@bjoernricks @greenbone/gsa-maintainers Seems those entries where unrelated to this MR and at least the RADIUS entry is now duplicated in the changelog (similar happened in #2957 as well).
This was referenced Jun 14, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an automatic backport of pull request #2948 done by Mergify.
Cherry-pick of d0b8867 has failed:
To fix up this pull request, you can check it out locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/
Mergify commands and options
More conditions and actions can be found in the documentation.
You can also trigger Mergify actions by commenting on this pull request:
@Mergifyio refreshwill re-evaluate the rules@Mergifyio rebasewill rebase this PR on its base branch@Mergifyio updatewill merge the base branch into this PR@Mergifyio backport <destination>will backport this PR on<destination>branchAdditionally, on Mergify dashboard you can:
Finally, you can contact us on https://mergify.io/