Cookies: set samesite: Lax by default
#8304
Conversation
stsewd
force-pushed
the
use-default-same-site
branch
2 times, most recently
from
b622fdf to
b1d47e4
Compare
The django's default is `Lax`, so I'm removing the setting. I'm overriding only for .org in our ops repos. We also are only allowing cross site requests from public versions only. Even if the domain is known, if the version is private we don't set the CORS header.
stsewd
force-pushed
the
use-default-same-site
branch
from
b1d47e4 to
693551f
Compare
|
I have made this value depend on use_promos, so no changes on the ops repo are required. I think we still need readthedocs/sphinx-hoverxref#134 so people with private projects can use the extension more easily, but isn't required. |
| Search is exposed through our API that's proxied from the domain where your docs are being served. | ||
| This is ``https://docs.readthedocs.io/_/api/v2/search`` for the ``docs`` project, for example. | ||
| If you are using :doc:`/commercial/index` you will need to replace | ||
| https://readthedocs.org/ with https://readthedocs.com/ in all the URLs used in the following examples. |
There was a problem hiding this comment.
This should be under it's own section, probably Read the Docs for Business Users or similar
There was a problem hiding this comment.
This is describing the API and examples, not sure if I follow about having another section
There was a problem hiding this comment.
Like, we need a section of the docs explaining the 2 different sites and endpoints (and auth, etc.), and then probably link to it from here for more detail.
docs/server-side-search.rst
Outdated
| @@ -194,3 +194,7 @@ If you are using :ref:`private versions <versions:privacy levels>`, | |||
| users will only be allowed to search projects they have permissions over. | |||
| Authentication and authorization is done using the current session, | |||
| or any of the valid :doc:`sharing methods </commercial/sharing>`. | |||
|
|
|||
| Cookie sessions can be used only from the same domain as the API, | |||
There was a problem hiding this comment.
This needs to be explained more. What is the takeaway for a user? When should they use this URL instead?
Presumably this should use a readthedocs.com example, where it's most necessary.
There was a problem hiding this comment.
This needs to be explained more. What is the takeaway for a user? When should they use this URL instead?
This is under the "Authentication and authorization" section of this doc, the paragraph above explains this is for private versions. I have changed this paragraph to avoid mentioning cookies.
The django's default is
Lax, so I'm removing the setting.I'm overriding only for .org in our ops repos.
We also are only allowing cross site requests
from public versions only.
Even if the domain is known,
if the version is private we don't set the CORS header.
Note: this is just to add another layer of security to our resources.