chore: unsafe session cookies for development

Author: olevski

internal/config/config.yaml

@@ -22,6 +22,7 @@ sessions:
     - issuer: https://renkulab.io/auth/realms/Renku
       audience: renku
       authorizedParty: renku-cli
+  unsafeCookieTemplate: false
 revproxy:
   renkuBaseUrl: "https://renkulab.io"
   externalGitlabUrl:

internal/config/session.go

@@ -11,6 +11,8 @@ type SessionConfig struct {
 	// NOTE: UnsafeNoCookieHandler should only be used for testing, in production this has to be false/unset
 	// without this there is no CSRF protection on the oauth callback endpoint
 	UnsafeNoCookieHandler bool
+	// NOTE: Unsafe cookie template should only be used for testing. It is NOT SAFE for production.
+	UnsafeCookieTemplate bool
 }
 
 type AuthorizationVerifier struct {
@@ -29,5 +31,8 @@ func (c *SessionConfig) Validate(e RunningEnvironment) error {
 	if e != Development && c.UnsafeNoCookieHandler {
 		return fmt.Errorf("a cookie handler needs to be configured in production")
 	}
+	if e != Development && c.UnsafeCookieTemplate {
+		return fmt.Errorf("a safe cookie template needs to be configured in production")
+	}
 	return nil
 }

internal/sessions/session_store.go

@@ -312,6 +312,24 @@ func WithConfig(c config.SessionConfig) SessionStoreOption {
 			}
 			sessions.cookieHandler = securecookie.New(cookieHashKey, cookieEncKey)
 		}
+		if c.UnsafeCookieTemplate {
+			unsafeCookieTmpl := func() http.Cookie {
+				defaultTmpl := defaultSessionCookieTemplate()
+				return http.Cookie{
+					Name:    defaultTmpl.Name,
+					Path:    defaultTmpl.Path,
+					Domain:  defaultTmpl.Domain,
+					Expires: defaultTmpl.Expires,
+					MaxAge:  defaultTmpl.MaxAge,
+					// NOTE: Secure needs to be true so that the SameSite = None works
+					// Enables calling a deployed backend from a local ui client version running on localhost
+					Secure:   true,
+					HttpOnly: false,
+					SameSite: http.SameSiteNoneMode,
+				}
+			}
+			sessions.cookieTemplate = unsafeCookieTmpl
+		}
 
 		sessions.sessionMaker = NewSessionMaker(WithIdleSessionTTLSeconds(c.IdleSessionTTLSeconds), WithMaxSessionTTLSeconds(c.MaxSessionTTLSeconds))
 
@@ -333,16 +351,18 @@ func WithCookieHandler(h models.CookieHandler) SessionStoreOption {
 	}
 }
 
+func defaultSessionCookieTemplate() http.Cookie {
+	return http.Cookie{
+		Name:     SessionCookieName,
+		Path:     "/",
+		Secure:   true,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode}
+}
+
 func NewSessionStore(options ...SessionStoreOption) (*SessionStore, error) {
 	sessions := SessionStore{
-		cookieTemplate: func() http.Cookie {
-			return http.Cookie{
-				Name:     SessionCookieName,
-				Path:     "/",
-				Secure:   true,
-				HttpOnly: true,
-				SameSite: http.SameSiteLaxMode}
-		},
+		cookieTemplate: defaultSessionCookieTemplate,
 	}
 	for _, opt := range options {
 		err := opt(&sessions)