Repository navigation
fix: dynamically default PHP_SESSION_COOKIE_SECURE based on BASE_URL - #466
Conversation
Default PHP_SESSION_COOKIE_SECURE to false when BASE_URL starts with http://, preventing browser session cookie drops and CSRF errors on HTTP custom domain deployments, while preserving explicit user overrides.
|
Hi @ostefano, could you please take a look at these changes and let me know if they are OK to move forward? I have already tested them on my end and everything is working properly. |
|
@Diogo-Rego see comment |
|
@ostefano That said, would it be better to move this protocol check logic from |
| export PHP_SESSION_AUTO_REGENERATE=${PHP_SESSION_AUTO_REGENERATE:-false} | ||
| export PHP_SESSION_CHECK_AGENT=${PHP_SESSION_CHECK_AGENT:-false} | ||
| export PHP_SESSION_COOKIE_SECURE=${PHP_SESSION_COOKIE_SECURE:-true} | ||
| if [ -z "${PHP_SESSION_COOKIE_SECURE}" ]; then |
There was a problem hiding this comment.
I believe we are half way there with this changeset. Either we expose the var, and allow both compose.yml and .env to modify it, or we assume that the user can not and shall not set it, and we always enable it if possible.
In other words, if we pick (1), my bad, please revert the change in template.
If we pick (2) then we need to remove the line from compose.yml and change the conditional here.
@pascaliske would you agree?
There was a problem hiding this comment.
I agree with Option (2) as well. Since BASE_URL already strictly defines whether HTTP or HTTPS is used, automating it transparently is much cleaner and avoids unnecessary configuration knobs.
I've updated the PR accordingly:
- Removed
PHP_SESSION_COOKIE_SECUREentirely fromdocker-compose.yml(andtemplate.env). - Evaluated
session.cookie_securedirectly based onBASE_URLinsideconfigure_misp.sh(falseifhttp://*, otherwisetrue).
There was a problem hiding this comment.
Bit late with my reply... I think automatically configuring this based on BASE_URL is perfectly fine.
setting Infer session.cookie_secure directly from BASE_URL in configure_misp.sh, enabling it whenever possible without requiring or exposing the PHP_SESSION_COOKIE_SECURE variable in docker-compose.yml and template.env.
3 participants
Fixes #463
When deploying
misp-dockerover plain HTTP with a custom Fully Qualified Domain Name (FQDN) inBASE_URL(e.g.,http://misp.domain.com), modern browsers refuse to store or transmit cookies with theSecureflag set over insecure connections.Previously,
PHP_SESSION_COOKIE_SECUREdefaulted unconditionally totrue. While browsers grantlocalhostexemptions, domain-based HTTP deployments dropped the session cookie on login POST requests, causing MISP to display:This PR allows
PHP_SESSION_COOKIE_SECUREto gracefully and dynamically adapt to the protocol defined inBASE_URL.Changes
core/files/entrypoint.sh: WhenPHP_SESSION_COOKIE_SECUREis unset or empty, checkBASE_URL. If it starts withhttp://, defaultPHP_SESSION_COOKIE_SECUREtofalse; otherwise default totrue. Explicit user configurations are preserved.docker-compose.yml: Removed hardcoded:-truefallback fromPHP_SESSION_COOKIE_SECUREso unset variables pass through cleanly for container entrypoint evaluation.template.env: Updated comments explaining the dynamic default behavior.