Ck_login_id + others Samesite attribue missing

English Language - Forum 📦 Install & Upgrade Help
1

When logging into SuiteCRM, a number of post login cookies are set, typically starting ck_login, such as ID, theme, language and others.

None of these are being set with a Secure or SameSite attribute, which based on browser warnings will by default be treated as lax and will impact cross site logins.
These cookies appear to be set through /include/MVC/SugarApplication.php.

Does someone know how to update this to correctly set a samesite attribute like Secure, Samesite=None ?
Message from Browser:
Cookie “ck_login_id_20” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”

2

Try this.

Report back whether this solved your issue…

3

Hi @chris001

Copied the new file and replaced the one on my server. After putting in place, the page breaks when you try and login.
I did a little digging and found some references as to the format.
In your code you had [“expire” => $expire, but I believe (at least looking at another example, it looks like “expires” must have the the “s”.
I don’t know how much it matters, but there were also some context that had => $xx, and others that we =>$xx without a space, and using double vs single quotes… as I said really don’t know how much that matters or if it was just the missing “s”.
This is what I change line 816 to and after that the user was able to login again.
As I am using an iframe I changed Strict to None once I had things working in first party

           setcookie($name, $value, ['expires' => $expire, 'path' => $path, 'domain' => $domain,
                                      'secure' => $secure, 'httponly' => $httponly, 'samesite' => $samesite]);

I did notice that in the code at around 806 there were some “If” statements that would pull the value that had been set in the PHP.ini file session.cookie_path in order to set the $path value.
Could the same be done for some of the other cookie values, so that if you set the php.ini to samesite None, it will be picked up and applied here as well so that making the change will be persistent across future upgrades and can be configured from one place. If it is using some of the settings, why not use more of them.
My webserver CSP rules block iframe requests if it does not match what has been allowed and I believe SuiteCRM does the same in its config. If the cookie value hasn’t been set in the php.ini then default to either lax or strict.

Thanks for your help in getting this one solved for me…

4

Fix updated. Uses setting in php.ini file, session.cookie_samesite.

5

Hi @chris001
Thanks, at first the change didn’t work… there was a slight type.

Line 821, need change $path to $samesite. After I changed that and connected the cookie was correctly set.

       $defaultCookieSameSite = ini_get('session.cookie_samesite');
         if ($samesite === null) {
             if(empty($defaultCookieSameSite)) {
                 $samesite = 'Strict';
             } else {
                 $samesite = $defaultCookieSameSite;
             }

Thanks for all the help with this.

6

Typo fixed. PR updated. Thanks.

7

Ck_login_id + other cookies - showing the wrong domain - eg 127.0.0.1 - when using a reverse proxy

This is totally seperate problem - but as it applies to the same cookies: I’ll mention it here.
Eg when using nginx as reverse proxy (may also apply to Apache as reverse proxy - I don’t have evidence either way)

The root cause is that nginx needs to pass on the ‘Host’ value - because those cookies need that value when being set.

Solution:
This line is needed:

  • proxy_set_header Host $host;

In the config block : eg

location /some/path/ {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_pass http://localhost:8000;
}

If anyone