From: Jo-Philipp Wich <jo@mein.io>
Date: Wed, 29 Jan 2020 08:07:51 +0000 (+0100)
Subject: luci-base: add another magic security attribute to the sysauth cookie
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=5879390cd10932638be70da2e3f04daa230e21fb;p=oweals%2Fluci.git

luci-base: add another magic security attribute to the sysauth cookie

Fixes: #3585
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 885c97da535c0c77d79e53391de5c37f2704e01a)
---

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index b43b94fde..17228ac32 100644
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -514,7 +514,7 @@ function dispatch(request)
 				return
 			end
 
-			http.header("Set-Cookie", 'sysauth=%s; path=%s; HttpOnly%s' %{
+			http.header("Set-Cookie", 'sysauth=%s; path=%s; SameSite=Strict; HttpOnly%s' %{
 				sid, build_url(), http.getenv("HTTPS") == "on" and "; secure" or ""
 			})
 			http.redirect(build_url(unpack(ctx.requestpath)))