How can I redirect after OAUTH2 with SameSite = Strict and still receive my cookies?

Question

G'day! In addition to 40781534 , for which the accepted answer is to set SameSite=Lax :

How can I set the SameSite=Strict cookie to redirect myself so that I return cookies from Chrome 56.0.2924.87 , even if the user request itself became a redirect from the login page on my OAUTH2 provider?

Complete request chain:

• POST https://provider.com/callback → 302 FOUND with:

   Location: https://me/login?code=xxx&state=yyy 

• GET https://example.com/login?code=xxx&state=yyy → 302 FOUND or 303 SEE OTHER (doesn't seem to matter):

   Location: https://example.com/destination Set-Cookie: sid=zzzz; Secure; HttpOnly; SameSite=Strict; Path=/ 

• GET https://example.com/destination → 401 GET OFF MY LAWN because the browser did not present the sid cookie

• GET https://example.com/destination → 200 OK if I update, because then the site is the same and my browser presents a sid cookie

I appreciate the potential of CSRF to represent sid before /destination for the general case of the last loaded user page not located at example.com , but I just installed it from /login , and I am one of which is now redirected to /destination .

Of course, I could set SameSite=Lax , but then there would be no way to create clicks if someone could find a way to redirect their choice from my site by incorrectly generating the URL?

Answer 1

I do not think that this can be done for security reasons. SameSite=Strict means that if a user was redirected or simply clicked on a link to your site (from another host), cookies should not be sent. And redirection is like chaining requests. Therefore, if your server is redirected to another one, and this server redirects back immediately with the 3xx code, a cookie will be sent because your server is "on top" of this chain.

However, if you are redirected to the oauth provider, and the user must allow you access to his account, this means that this "chain" is broken and the cookie will no longer be sent even if your site sets it (it is installed, however, does not sent). Your redirect is simply an “extension” of the clicked “allow” link.

If you want other users not to depend on your site, just use nonce in the link if you think you need to prevent this behavior, and this can be dangerous if you do not. But consider that most providers check you if the redirect URL was previously defined and resolved by your application.

Here are other solutions (use only if you know what you are doing, and you can take 100% responsibility).

• Prepare the site with the link "Continue to the site" (the cookie, of course, will be sent after the link to the link).
• Refresh Window Using JavaScript
• Prepare a site with JavaScript that redirects the user.
• Combine the first and third methods with a cleaner solution and work without JavaScript support in the browser.

I used the second one during development, now I use the same lax site (this was the default in Hapi, possibly up to 15 ver., So this is not so bad).