github/qBittorrent
1
0
Fork 0
mirror of https://github.com/qbittorrent/qBittorrent synced 2025-07-31 12:00:16 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Revise cookie 'secure flag' enable condition

Browse source 
The localhost is 'potentially trustworthy' and RFC 6265 allows setting secure flag in this case.
Also check `X-Forwarded-Proto` header value to support reverse proxy usage.

Note: for reverse proxy users, now the `X-Forwarded-Proto` header is expected to be sent to qbt
otherwise the `secure` flag might be set erroneously.

https://datatracker.ietf.org/doc/html/rfc6265#section-4.1.2.5
https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy

Closes #21250.
PR #21260.
This commit is contained in:
Chocobo1 2024-09-07 21:38:27 +08:00 • committed by GitHub
parent d9bc7935eb
commit 130c0d8487
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 27 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

23
src/webui/webapplication.cpp
View file

@ -744,7 +744,7 @@ void WebApplication::sessionStart()
QNetworkCookie cookie {m_sessionCookieName.toLatin1(), m_currentSession->id().toLatin1()};
cookie.setHttpOnly(true);
cookie.setSecure(m_isSecureCookieEnabled && m_isHttpsEnabled);
cookie.setSecure(m_isSecureCookieEnabled && isOriginTrustworthy()); // [rfc6265] 4.1.2.5. The Secure Attribute
cookie.setPath(u"/"_s);
if (m_isCSRFProtectionEnabled)
cookie.setSameSitePolicy(QNetworkCookie::SameSite::Strict);
@ -767,6 +767,27 @@ void WebApplication::sessionEnd()
setHeader({Http::HEADER_SET_COOKIE, QString::fromLatin1(cookie.toRawForm())});
}
bool WebApplication::isOriginTrustworthy() const
{
// https://w3c.github.io/webappsec-secure-contexts/#is-origin-trustworthy
if (m_isReverseProxySupportEnabled)
{
const QString forwardedProto = request().headers.value(Http::HEADER_X_FORWARDED_PROTO);
if (forwardedProto.compare(u"https", Qt::CaseInsensitive) == 0)
return true;
}
if (m_isHttpsEnabled)
return true;
// client is on localhost
if (env().clientAddress.isLoopback())
return true;
return false;
}
bool WebApplication::isCrossSiteRequest(const Http::Request &request) const
{
// https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Verifying_Same_Origin_with_Standard_Headers