From: Jo-Philipp Wich <jo@mein.io>
Date: Wed, 29 Jan 2020 08:07:51 +0000 (+0100)
Subject: luci-base: add another magic security attribute to the sysauth cookie
X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=885c97da535c0c77d79e53391de5c37f2704e01a;p=oweals%2Fluci.git

luci-base: add another magic security attribute to the sysauth cookie

Fixes: #3585
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
---

diff --git a/modules/luci-base/luasrc/dispatcher.lua b/modules/luci-base/luasrc/dispatcher.lua
index 48e125e4a..32d34da01 100644
--- a/modules/luci-base/luasrc/dispatcher.lua
+++ b/modules/luci-base/luasrc/dispatcher.lua
@@ -806,7 +806,7 @@ function dispatch(request)
 				return tpl.render("sysauth", { duser = "root", fuser = user })
 			end
 
-			http.header("Set-Cookie", 'sysauth=%s; path=%s; HttpOnly%s' %{
+			http.header("Set-Cookie", 'sysauth=%s; path=%s; SameSite=Strict; HttpOnly%s' %{
 				sid, build_url(), http.getenv("HTTPS") == "on" and "; secure" or ""
 			})