Differences From Artifact [c2fbc76c58]:

• File src/cgi.c — part of check-in [88a402fe2a] at 2023-09-18 13:18:41 on branch csrf-defense-enhancement — Try to simplify and rationalize the defenses against cross-site request forgery attacks. A hodgepodge of techniques have been used in the past. This changes attempts to make everything work more alike and to centralize CSRF defenses for easier auditing. (user: drh size: 85975)

To Artifact [e5d9bc3721]:

• File src/cgi.c — part of check-in [bc643c32f8] at 2023-09-18 15:36:39 on branch csrf-defense-enhancement — Set the "SameSite=strict" value on cookies (used for authentication) as a further defense-in-depth against CSRF attacks. (user: drh size: 85979)

312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332

    if( zPath[0]==0 ) zPath = "/";
  }
  if( g.zBaseURL!=0 && fossil_strncmp(g.zBaseURL, "https:", 6)==0 ){
    zSecure = " secure;";
  }
  if( lifetime!=0 ){
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; max-age=%d; HttpOnly; "
       "%s Version=1\r\n",
       zName, lifetime>0 ? zValue : "null", zPath, lifetime, zSecure);
  }else{
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; HttpOnly; "
       "%s Version=1\r\n",
       zName, zValue, zPath, zSecure);
  }
}


/*
** Return true if the response should be sent with Content-Encoding: gzip.

|
|



|
<

312
313
314
315
316
317
318
319
320
321
322
323
324

325
326
327
328
329
330
331

    if( zPath[0]==0 ) zPath = "/";
  }
  if( g.zBaseURL!=0 && fossil_strncmp(g.zBaseURL, "https:", 6)==0 ){
    zSecure = " secure;";
  }
  if( lifetime!=0 ){
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; max-age=%d; HttpOnly; SameSite=strict;"
       " %s\r\n",
       zName, lifetime>0 ? zValue : "null", zPath, lifetime, zSecure);
  }else{
    blob_appendf(&extraHeader,
       "Set-Cookie: %s=%t; Path=%s; HttpOnly; SameSite=strict; %s\r\n",

       zName, zValue, zPath, zSecure);
  }
}


/*
** Return true if the response should be sent with Content-Encoding: gzip.