GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-29613: Added support for SameSite cookies by alex · Pull Request #6413 · python/cpython

Conversation

@alex

@alex alex commented Apr 7, 2018 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

This is a rebase of #214.

Closes #214

https://bugs.python.org/issue29613

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
akash0x53 and others added 9 commits April 7, 2018 13:47
@akash0x53 @alex
bpo-29613: Added support for SameSite cookies
89c0821 
Implemented as per draft
https://tools.ietf.org/html/draft-west-first-party-cookies-07
@akash0x53 @alex
Documented SameSite
3f1b130 
And suggestions by members.
@akash0x53 @alex
Missing space :(
7d69cd9
@akash0x53 @alex
Updated News and contributors
b585315
@akash0x53 @alex
Added version changed details.
81446f6
@akash0x53 @alex
Fix in documentation
21d0bda
@akash0x53 @alex
fix in documentation
cc06dd1
@akash0x53 @alex
Clubbed test cases for same attribute into single.
dc750c3
@alex
Updates
d496c01
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Apr 7, 2018
@bedevere-bot bedevere-bot added the awaiting merge label Apr 7, 2018
@alex
Style nits + expand tests
dcd0afa
@alex
alex requested a review from dstufft April 7, 2018 17:58
@alex alex mentioned this pull request Apr 7, 2018
bpo-29613: Added support for SameSite cookies #214
Closed
timgraham
timgraham reviewed Apr 7, 2018
View reviewed changes
Comment thread Doc/library/http.cookies.rst Outdated
setting them.

.. versionchanged:: 3.8
Added support for :attr:`samesite` attribute.

@timgraham timgraham Apr 7, 2018

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for the

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Doc/library/http.cookies.rst Outdated
in HTTP requests, and is not accessible through JavaScript. This is intended
to mitigate some forms of cross-site scripting.

The attribute :attr:`samesite` specifies that browser is not allowed to send the

@timgraham timgraham Apr 7, 2018

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"the browser"

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Doc/library/http.cookies.rst Outdated
to mitigate some forms of cross-site scripting.

The attribute :attr:`samesite` specifies that browser is not allowed to send the
cookie along with cross-site requests. This help to mitigate CSRF attacks. Valid

@timgraham timgraham Apr 7, 2018

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

help -> helps

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread Lib/test/test_http_cookies.py Outdated
'Set-Cookie: Customer="WILE_E_COYOTE"; HttpOnly; Secure')

def test_samesite_attrs(self):
samesite_values = ['Strict', 'Lax']

@timgraham timgraham Apr 7, 2018

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might add tests for 'strict' and 'lax' as the values are case-insensitive from what I read.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@alex
review feedback
9259d2e
@alex

alex commented Apr 7, 2018

Copy link
Copy Markdown
Member Author

Thanks! Feedback addressed
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
dstufft
dstufft approved these changes Apr 7, 2018
View reviewed changes
@alex
alex merged commit c87eb09 into python:master Apr 7, 2018
@bedevere-bot bedevere-bot removed the awaiting merge label Apr 7, 2018
@alex
alex deleted the samesite-cookies branch April 7, 2018 20:09
@alex

alex commented Apr 7, 2018

Copy link
Copy Markdown
Member Author

@akash0x53 I would encourage you to apply for a Google Patch Reward for your work on this: https://www.google.com/about/appsecurity/patch-rewards/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@Changaco Changaco mentioned this pull request Jun 5, 2018
Restrict cookies to same-site requests by default liberapay/liberapay.com#1133
Merged
@minrk minrk mentioned this pull request Jan 18, 2019
support samesite xsrf cookie tornadoweb/tornado#2573
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@dstufft dstufft dstufft approved these changes
+1 more reviewer
@timgraham timgraham timgraham left review comments
Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@alex @dstufft @timgraham @the-knights-who-say-ni @bedevere-bot @akash0x53
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.