You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/01/16 21:36:11 UTC
[I] Configure session cookie security attributes (Secure, HttpOnly, SameSite) (tooling-trusted-releases)
andrewmusselman opened a new issue, #543:
URL: https://github.com/apache/tooling-trusted-releases/issues/543
## Summary
Session cookie security attributes are not explicitly configured, relying on external library defaults that cannot be verified.
## ASVS Requirements
- 3.4.1 - Cookie-based session management
- 3.4.2 - Cookie HttpOnly attribute
- 14.3.1 - Cookie security attributes
## Related Audit Reports
- [Weak Cryptography #399](ASVS/weak-cryptography-399.md) - Section 1
- [External Access #400](ASVS/external-access-400.md) - Section 3.4.2
- [Credential Stealing #403](ASVS/credential-stealing-403.md) - Section 4
## Affected Files
- `atr/config.py` - Missing configuration
- `atr/server.py` - Missing configuration
## Current Behavior
No explicit SESSION_COOKIE_* settings found. Session management delegated to asfquart library.
## Recommended Fix
```python
# In atr/config.py, add to AppConfig class:
class AppConfig:
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True
SESSION_COOKIE_SAMESITE = 'Lax'
SESSION_COOKIE_NAME = '__Host-session' # Additional security with __Host- prefix
```
## Acceptance Criteria
- [ ] SESSION_COOKIE_SECURE = True
- [ ] SESSION_COOKIE_HTTPONLY = True
- [ ] SESSION_COOKIE_SAMESITE = 'Lax' (or 'Strict')
- [ ] Verify asfquart respects these settings
- [ ] Consider __Host- prefix for additional security
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Configure session cookie security attributes (Secure, HttpOnly, SameSite) (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave closed issue #543: Configure session cookie security attributes (Secure, HttpOnly, SameSite)
URL: https://github.com/apache/tooling-trusted-releases/issues/543
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Configure session cookie security attributes (Secure, HttpOnly, SameSite) (tooling-trusted-releases)
Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #543:
URL: https://github.com/apache/tooling-trusted-releases/issues/543#issuecomment-3785260054
ASFQuart uses `Strict` for `SameSite`. Fixed in 69dc859b480ff6ca6fdb68d6b7d7160cd110f311.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org