Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@DL6ER
Copy link
Member

@DL6ER DL6ER commented May 30, 2025

What does this implement/fix?

Follow-up and possible solution (yet undecided!) on #2470

Related issue or feature (if applicable): Fixes #2470

Pull request in docs with documentation (if applicable): N/A


By submitting this pull request, I confirm the following:

  1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
  2. I have commented my proposed changes within the code.
  3. I am willing to help maintain this change if there are issues with it later.
  4. It is compatible with the EUPL 1.2 license
  5. I have squashed any insignificant commits. (git rebase)

Checklist:

  • The code change is tested and works locally.
  • I based my code and PRs against the repositories developmental branch.
  • I signed off all commits. Pi-hole enforces the DCO for all contributions
  • I signed all my commits. Pi-hole requires signatures to verify authorship
  • I have read the above and my PR is ready for review.

@yubiuser
Copy link
Member

I'm not sure if this is a good change, as we lower the security. However, I'm not that confident with this cookie option and don't feel like overseeing all the implications.
How about a middle ground: don't change it in general, but add it to webserver.headers (defaulting to 'strict') giving users the ability to change it themselves?

@rdwebdesign
Copy link
Member

I don't think there will be any issues using Lax.

Lax is the default value for this option. It is automatically set by browsers if SameSite is not present).

Using it will allow to users to use direct links to inner pages (we want the authentication cookie to be sent in this case, to avoid the login page).

@DL6ER
Copy link
Member Author

DL6ER commented May 30, 2025

I tend towards the "Lax is fine", the more reading I'm doing on this. See also a very similar discussion elsewhere: gofiber/fiber#1639

@DL6ER DL6ER marked this pull request as ready for review June 4, 2025 18:50
@DL6ER DL6ER requested a review from a team as a code owner June 4, 2025 18:50
@DL6ER
Copy link
Member Author

DL6ER commented Jun 4, 2025

Rebased on latest development and marked as ready to go.

@DL6ER
Copy link
Member Author

DL6ER commented Jun 5, 2025

@yubiuser what do you say? I'm not going to merge this against your objections if they still hold, I can understand it but I, personally, think it's fine. I have not been thinking long enough possible implications when I wrote this initially. @rdwebdesign is right that this is a breaking change because PHP is doing what we want to do in this PR as default

@yubiuser
Copy link
Member

yubiuser commented Jun 5, 2025

If the two of you are good with the change I don't have objections. Esp. when

Lax is the default value for this option

__

Did you consider my suggestion

How about a middle ground: don't change it in general, but add it to webserver.headers (defaulting to 'strict') giving users the ability to change it themselves?

@rdwebdesign
Copy link
Member

If you think we should allow users to freely set this option, personally I think we should set Lax and allow users to set as Strict or even SameSite=None; Secure.

@rdwebdesign rdwebdesign requested a review from yubiuser June 7, 2025 01:36
@DL6ER
Copy link
Member Author

DL6ER commented Jun 7, 2025

Sorry, I did not see the two comments thus far. I don't think an option is useful here, it's rather unlikely that any user will really change it.

@rdwebdesign
Copy link
Member

Yeah... I don't think we need another option here.

@DL6ER DL6ER merged commit 6759df3 into development Jun 7, 2025
20 checks passed
@DL6ER DL6ER deleted the tweak/lax branch June 7, 2025 05:56
@DL6ER DL6ER mentioned this pull request Jun 9, 2025
@pralor-bot
Copy link

This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/pi-hole-ftl-v6-2-3-released/80593/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants