[Tenable] Cookie Without SameSite Flag Detected (revisit when we upgrade to Django 2.1)

[lbeaufort]

1. Cookie Without SameSite Flag Detected

When the SameSite flag is set on a cookie, the browser will prevent it from being sent along with cross-site requests. This can help prevent Cross-Site Request Forgery (CSRF) attacks. |
Remediation path: If the cookie contains sensitive information, then the server should ensure that the cookie has the SameSite flag set. This flag can have two values: strict or lax. With the strict value the cookie will only be sent if the request originates from the same website. With the lax value the cookie will only be sent for GET requests.
References: https://www.owasp.org/index.php/SameSite

2. Cookie Without Secure Flag Detected

When the secure flag is set on a cookie, the browser will prevent it from being sent over a clear text channel (HTTP) and only allow it to be sent when an encrypted channel is used (HTTPS). The scanner discovered that a cookie was set by the server without the secure flag being set. Although the initial setting of this cookie was via an HTTPS connection, any HTTP link to the same server will result in the cookie being sent in clear text. Note that if the cookie does not contain sensitive information, the risk of this vulnerability is mitigated.
Remediation path: If the cookie contains sensitive information, then the server should ensure that the cookie has the secure flag set.
References:
https://www.owasp.org/index.php/SecureFlag

Moved #2 to #3102

[rfultz]

@lbeaufort is there more information about this? Are the cookies in question being set on a specific page or section of the site? What's the name of those cookies? As far as I can see, the cookies that we set are secure, though we're using Google Analytics that may be setting simpler cookies even though we're requesting that it use the secure options.

[lbeaufort]

Sorry the message is so vague, it's what I was sent. Here's the only other helpful data I could dig out from the report, let me know if this helps at all:

• (URL of prod cloud.gov app, not proxy url - let me know if you need this) returned a cookie named 'csrftoken' that does not set the SameSite cookie flag correctly
• (URL of prod cloud.gov app, not proxy url - let me know if you need this) returned cookie '_gat_GSA_ENOR0' without the Secure flag set.

[rfultz]

Was working on this last week. Doesn't seem crucial for our cookie use (e.g., PII) but @patphongs advised to check with Michael. Will reach out to him.

[rfultz]

It looks like we may not be able to address #1 until we upgrade to at least Django 2.1 when the SameSite capability was added: https://docs.djangoproject.com/en/2.2/ref/settings/#std:setting-SESSION_COOKIE_SAMESITE

[rfultz]

I have an email out to GSA about #2

[rfultz]

It looks like we may need to mark these two different issues as known / won't fix.

#1 - We can fix it after we upgrade to Django 2.1 but it's not a big issue for us since we aren't offering users anything near logins and we aren't collecting PII

#2- I got a reply from Freddie at DAP that the cookie doesn't contain PII (and, not being our cookie, we can't really change anything about it):

"The cookie you mention does not contain sensitive information. The information stored in that cookie is only used for Google Analytics and according to GA360 terms of service does not contain any personally identifiable information."

[rfultz]

Moving #2 to #3102

[PaulClark2]

Blocked until we upgrade to Django 2.1. Leaving in the blocked pipeline for now.

[pkfec]

Django was recently upgraded to LTS v2.2.10 and deployed to dev space on 02/28/2020. With the latest upgrade, the CSRF token will be set to Lax by default (for GET requests) which means the browser will not send the cookie cross-domain with unsafe requests (like POST).
I verified that the CSRF token is now being set to Lax in both dev and stage spaces. We should see this token set in Production after 11.5 release(03/10/2020).

The CSRF token is NOW set after the Django upgrade. We can close this issue.

Django v2.2 documentation:
:https://docs.djangoproject.com/en/2.2/ref/settings/#session-cookie-samesite

cc @rfultz @patphongs @lbeaufort

[jason-upchurch]

@lbeaufort @pkfec @patphongs this was reopened so I'm moving it from Sprint 11.6 to "no milestone" and adding "Needs prioritization".

[patphongs]

Samesite flag is set on the CSRF token, this is remediated.