From f828642b5239ee2c61e9d0a83df7970af222513d Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 22:15:57 -1000 Subject: Name the auth cookie __Host- where it can be Without the prefix any host under the same domain could set a cgitauth cookie of its own, signing a visitor in as someone else or out. --- custom/extensions/auth-inline.lua | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'custom/extensions/auth-inline.lua') diff --git a/custom/extensions/auth-inline.lua b/custom/extensions/auth-inline.lua index bce2472..ae21c7a 100644 --- a/custom/extensions/auth-inline.lua +++ b/custom/extensions/auth-inline.lua @@ -100,6 +100,14 @@ local cookie_insecure = false -- the password's length, and one longer than this is turned down unchecked. local max_password_bytes = 256 +-- A browser accepts a cookie named __Host- only when it is Secure, covers the +-- whole host and was set by this host, so no sibling subdomain can plant a +-- session in its place. Either cookie setting above can rule that out. +local session_cookie = cookie_name +if not cookie_insecure and cookie_path == "/" then + session_cookie = "__Host-" .. cookie_name +end + -- One request reaches this script as an open, a write and a close, so what the -- open decodes is kept here for the calls that follow. local action, http, cgit, post @@ -463,7 +471,7 @@ function authenticate_post() end -- A failed login answers with an empty session, which clears the cookie. - set_cookie(cookie_name, session) + set_cookie(session_cookie, session) html("\n") return 0 @@ -478,7 +486,7 @@ function authenticate_cookie() return 1 end - local cookie = get_cookie(http["cookie"], cookie_name) + local cookie = get_cookie(http["cookie"], session_cookie) local username = validate_value("username", cookie, account_hash) if username == nil or not accepted_users[username:lower()] then return 0 -- cgit