Fiber: 🐛 CSRF cookie is SameSite=Lax

[falsandtru]

Fiber version
2.0.2
Issue description
Should be Strict by default.
Code snippet

Set-Cookie: _csrf=0e854b50-dc6e-46c7-a6f2-30b1dffa49f1; expires=Fri, 25 Sep 2020 08:20:04 GMT; path=/; SameSite=Lax

[hi019]

Thanks for reporting this. I'll make a PR soon. For anyone wondering

Lax
Cookies are allowed to be sent with top-level navigations and will be sent along with GET request initiated by third party website. This is the default value in modern browsers.

Strict
Cookies will only be sent in a first-party context and not be sent along with requests initiated by third party websites.

[Fenny]

If the SameSite attribute is set to Strict, then the browser will not include the cookie in any requests that originate from another site. This is the most defensive option, but it can impair the user experience, because if a logged-in user follows a third-party link to a site, then they will appear not to be logged in, and will need to log in again before interacting with the site in the normal way. See more here: https://portswigger.net/web-security/csrf/samesite-cookies

I made a PR https://github.com/gofiber/fiber/compare/master...Fenny:master#diff-a1d2da43df7c00f48723bb4751a6c393 that allows you to override the default SameSite attribute in the csrf middleware. Will be shipped with the next tag v2.0.3

app.Use(csrf.New(csrf.Config{
    Cookie: &fiber.Cookie{
        SameSite: "Strict",
    }
}))

[falsandtru]

if a logged-in user follows a third-party link to a site, then they will appear not to be logged in, and will need to log in again before interacting with the site in the normal way.

CSRF cookie's SameSite value shoudn't affect the other cookies. So the session cookie should independently have the different SameSite value.

[Fenny]

@falsandtru you are right, I went over it too quickly and forgot about that. I will make a PR so the csrf mw will default to Strict 👍

[falsandtru]

Why not fixed? Lax can't prevent clickjacking.

[falsandtru]

Looks like the source code is fixed but the release note is wrong.

https://github.com/gofiber/fiber/releases/tag/v2.0.3

csrf middleware now sets SameSite=Lax by default #825