From 675c72f02e7565a937b40c23ec27df6d86f95dc3 Mon Sep 17 00:00:00 2001 From: Mark McDowall Date: Sun, 7 Mar 2021 15:10:56 -0800 Subject: [PATCH] Fixed: Set SameSite=Strict for SonarrAuth cookie Closes #4365 --- .../Authentication/EnableAuthInNancy.cs | 3 +- .../Authentication/SonarrNancyCookie.cs | 33 +++++++++++++++++++ 2 files changed, 34 insertions(+), 2 deletions(-) create mode 100644 src/Sonarr.Http/Authentication/SonarrNancyCookie.cs diff --git a/src/Sonarr.Http/Authentication/EnableAuthInNancy.cs b/src/Sonarr.Http/Authentication/EnableAuthInNancy.cs index b65121316..834ef1802 100644 --- a/src/Sonarr.Http/Authentication/EnableAuthInNancy.cs +++ b/src/Sonarr.Http/Authentication/EnableAuthInNancy.cs @@ -4,7 +4,6 @@ using Nancy; using Nancy.Authentication.Basic; using Nancy.Authentication.Forms; using Nancy.Bootstrapper; -using Nancy.Cookies; using Nancy.Cryptography; using NzbDrone.Common.Extensions; using NzbDrone.Core.Authentication; @@ -120,7 +119,7 @@ namespace Sonarr.Http.Authentication if (FormsAuthentication.DecryptAndValidateAuthenticationCookie(formsAuthCookieValue, FormsAuthConfig).IsNotNullOrWhiteSpace()) { - var formsAuthCookie = new NancyCookie(formsAuthCookieName, formsAuthCookieValue, true, false, DateTime.UtcNow.AddDays(7)) + var formsAuthCookie = new SonarrNancyCookie(formsAuthCookieName, formsAuthCookieValue, true, false, DateTime.UtcNow.AddDays(7)) { Path = GetCookiePath() }; diff --git a/src/Sonarr.Http/Authentication/SonarrNancyCookie.cs b/src/Sonarr.Http/Authentication/SonarrNancyCookie.cs new file mode 100644 index 000000000..a74379449 --- /dev/null +++ b/src/Sonarr.Http/Authentication/SonarrNancyCookie.cs @@ -0,0 +1,33 @@ +using System; +using Nancy.Cookies; + +namespace Sonarr.Http.Authentication +{ + public class SonarrNancyCookie : NancyCookie + { + public SonarrNancyCookie(string name, string value) : base(name, value) + { + } + + public SonarrNancyCookie(string name, string value, DateTime expires) : base(name, value, expires) + { + } + + public SonarrNancyCookie(string name, string value, bool httpOnly) : base(name, value, httpOnly) + { + } + + public SonarrNancyCookie(string name, string value, bool httpOnly, bool secure) : base(name, value, httpOnly, secure) + { + } + + public SonarrNancyCookie(string name, string value, bool httpOnly, bool secure, DateTime? expires) : base(name, value, httpOnly, secure, expires) + { + } + + public override string ToString() + { + return base.ToString() + "; SameSite=Strict"; + } + } +}