Skip to content

Commit 0cca038

Browse files
SaevenSaeven
authored
Merge pull request #63 from Saeven/feature/samesite-cookies
Samesite cookie policies now available.
2 parents 8178eb7 + 72c9aab commit 0cca038

File tree

5 files changed

+48
-49
lines changed

5 files changed

+48
-49
lines changed

‎bundle/Spec/CirclicalUser/Service/AuthenticationServiceSpec.php‎

Lines changed: 12 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@ public function let(AuthenticationMapper $authenticationMapper, UserMapper $user
7474
false,
7575
new PasswordNotChecked(),
7676
true,
77-
true
77+
true,
78+
'None'
7879
);
7980
}
8081

@@ -321,7 +322,6 @@ public function it_fails_when_any_cookies_are_missing()
321322
foreach ($results as $combinations) {
322323
$comboCount = count($combinations);
323324
if ($comboCount != 0 && $comboCount < 4) {
324-
325325
foreach ($cookieTypes as $c) {
326326
unset($_COOKIE[$c]);
327327
}
@@ -418,7 +418,6 @@ public function it_wont_overwrite_existing_auth_on_create($authenticationMapper,
418418

419419
public function it_wont_create_auth_when_email_usernames_belong_to_user_records($authenticationMapper, User $user5)
420420
{
421-
422421
$user5->getId()->willReturn(5);
423422
$user5->getEmail()->willReturn('alex@circlical.com');
424423
$this->shouldThrow(EmailUsernameTakenException::class)->during('create', [$user5, 'alex@circlical.com', 'pepperspray']);
@@ -455,7 +454,8 @@ public function it_will_create_new_auth_records_with_strong_passwords($authentic
455454
false,
456455
new Passwdqc(),
457456
true,
458-
true
457+
true,
458+
'None'
459459
);
460460

461461
$newAuth->getRawSessionKey()->willReturn(KeyFactory::generateEncryptionKey()->getRawKeyMaterial());
@@ -479,7 +479,8 @@ public function it_wont_create_new_auth_records_with_weak_passwords($authenticat
479479
false,
480480
new Passwdqc(),
481481
true,
482-
true
482+
true,
483+
'None'
483484
);
484485

485486
$newAuth->getRawSessionKey()->willReturn(KeyFactory::generateEncryptionKey()->getRawKeyMaterial());
@@ -505,7 +506,8 @@ public function it_wont_create_new_auth_records_with_weak_passwords_via_zxcvbn(
505506
false,
506507
new Zxcvbn([]),
507508
true,
508-
true
509+
true,
510+
'None'
509511
);
510512

511513
// Required, since the array-cast can't support closures which are passed by phpspec, even with getWrappedObject()
@@ -563,7 +565,8 @@ public function it_fails_to_create_tokens_when_password_changes_are_prohibited($
563565
false,
564566
new PasswordNotChecked(),
565567
true,
566-
true
568+
true,
569+
'None'
567570
);
568571
$this->shouldThrow(PasswordResetProhibitedException::class)->during('createRecoveryToken', [$user]);
569572
}
@@ -579,7 +582,8 @@ public function it_bails_on_password_changes_if_no_provider_is_set($authenticati
579582
false,
580583
new PasswordNotChecked(),
581584
true,
582-
true
585+
true,
586+
'None'
583587
);
584588
$this->shouldThrow(PasswordResetProhibitedException::class)->during('changePasswordWithRecoveryToken', [$user, 123, 'string', 'string']);
585589
}

‎config/circlical.user.local.php.dist‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,10 @@ return [
7575
*/
7676
'secure_cookies' => false,
7777

78+
/*
79+
* What SameSite policy do we give cookies? Can be set to null 'Strict, 'Lax' or 'None'
80+
*/
81+
'samesite_policy' => 'None',
7882

7983
/*
8084
* Forgot password functionality

‎src/CirclicalUser/Controller/CliController.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
namespace CirclicalUser\Controller;
44

55
use CirclicalUser\Entity\TemporaryResource;
6-
use CirclicalUser\Mapper\UserMapper;
76
use CirclicalUser\Provider\GroupPermissionProviderInterface;
87
use CirclicalUser\Provider\RoleProviderInterface;
98
use CirclicalUser\Provider\UserPermissionProviderInterface;

‎src/CirclicalUser/Factory/Service/AuthenticationServiceFactory.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,8 @@ public function __invoke(ContainerInterface $container, $requestedName, array $o
5454
$secure,
5555
$container->get(PasswordCheckerInterface::class),
5656
$userConfig['password_reset_tokens']['validate_fingerprint'] ?? true,
57-
$userConfig['password_reset_tokens']['validate_ip'] ?? false
57+
$userConfig['password_reset_tokens']['validate_ip'] ?? false,
58+
$userConfig['auth']['samesite_policy'] ?? 'None'
5859
);
5960
}
6061
}

‎src/CirclicalUser/Service/AuthenticationService.php‎

Lines changed: 30 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -52,69 +52,53 @@ class AuthenticationService
5252
*/
5353
public const COOKIE_VERIFY_B = '_sessionc';
5454

55-
5655
/**
5756
* Prefix for hash cookies, mmm.
5857
*/
5958
public const COOKIE_HASH_PREFIX = '__cu';
6059

6160
/**
6261
* Stores the user identity after having been authenticated.
63-
*
64-
* @var ?User
6562
*/
66-
private $identity;
63+
private ?User $identity;
6764

68-
/**
69-
* @var AuthenticationProviderInterface
70-
*/
71-
private $authenticationProvider;
65+
private AuthenticationProviderInterface $authenticationProvider;
7266

73-
/**
74-
* @var UserProviderInterface
75-
*/
76-
private $userProvider;
67+
private UserProviderInterface $userProvider;
7768

7869
/**
79-
* @var HiddenString A config-defined key that's used to encrypt ID cookie
70+
* A config-defined key that's used to encrypt ID cookie
8071
*/
81-
private $systemEncryptionKey;
72+
private HiddenString $systemEncryptionKey;
8273

8374
/**
84-
* @var bool Should the cookie expire at the end of the session?
75+
* Should the cookie expire at the end of the session?
8576
*/
86-
private $transient;
77+
private bool $transient;
8778

8879
/**
89-
* @var bool Should the cookie be marked as https only?
80+
* Should the cookie be marked as secure?
9081
*/
91-
private $secure;
82+
private bool $secure;
9283

84+
private PasswordCheckerInterface $passwordChecker;
9385

94-
/**
95-
* @var PasswordCheckerInterface
96-
*/
97-
private $passwordChecker;
98-
86+
private ?UserResetTokenProviderInterface $resetTokenProvider;
9987

10088
/**
101-
* @var ?UserResetTokenProviderInterface
89+
* If password reset is enabled, do we validate the browser fingerprint?
10290
*/
103-
private $resetTokenProvider;
104-
91+
private bool $validateFingerprint;
10592

10693
/**
107-
* @var boolean
108-
* If password reset is enabled, do we validate the browser fingerprint?
94+
* If password reset is enabled, do we validate the user IP address?
10995
*/
110-
private $validateFingerprint;
111-
96+
private bool $validateIp;
11297

11398
/**
114-
* @var boolean
115-
* If password reset is enabled, do we validate the user IP address?
99+
* Samesite cookie attribute
116100
*/
117-
private $validateIp;
101+
private string $sameSite;
118102

119103

120104
/**
@@ -129,6 +113,7 @@ class AuthenticationService
129113
* @param PasswordCheckerInterface $passwordChecker Optional, a password checker implementation
130114
* @param bool $validateFingerprint If password reset is enabled, do we validate the browser fingerprint?
131115
* @param bool $validateIp If password reset is enabled, do we validate the user IP address?
116+
* @param string $sameSite Should be one of 'None', 'Lax' or 'Strict'.
132117
*/
133118
public function __construct(
134119
AuthenticationProviderInterface $authenticationProvider,
@@ -139,8 +124,10 @@ public function __construct(
139124
bool $secure,
140125
PasswordCheckerInterface $passwordChecker,
141126
bool $validateFingerprint,
142-
bool $validateIp
127+
bool $validateIp,
128+
string $sameSite
143129
) {
130+
$this->identity = null;
144131
$this->authenticationProvider = $authenticationProvider;
145132
$this->userProvider = $userProvider;
146133
$this->systemEncryptionKey = new HiddenString($systemEncryptionKey);
@@ -150,6 +137,7 @@ public function __construct(
150137
$this->resetTokenProvider = $resetTokenProvider;
151138
$this->validateFingerprint = $validateFingerprint;
152139
$this->validateIp = $validateIp;
140+
$this->sameSite = $sameSite;
153141
}
154142

155143
/**
@@ -331,11 +319,14 @@ private function setCookie(string $name, string $value)
331319
setcookie(
332320
$name,
333321
$value,
334-
$expiry,
335-
'/',
336-
$sessionParameters['domain'],
337-
$this->secure,
338-
true
322+
[
323+
'expires' => $expiry,
324+
'path' => '/',
325+
'domain' => $sessionParameters['domain'],
326+
'secure' => $this->secure,
327+
'httponly' => true,
328+
'samesite' => $this->sameSite,
329+
]
339330
);
340331
}
341332

0 commit comments

Comments
 (0)