From 78f5b014eea92e128fe58e8bfb4b1df5cc76d8c3 Mon Sep 17 00:00:00 2001 From: naiba Date: Thu, 4 Jun 2026 16:19:25 +0000 Subject: [PATCH] fix(csrf): set Secure on csrf cookie only over HTTPS CodeQL go/cookie-secure-not-set (CWE-614) flagged the nz-csrf cookie as missing the Secure attribute. Mirror writeOauth2StateCookie and derive Secure from the request scheme instead of hardcoding it: forcing Secure=true would make browsers drop the cookie on plain-HTTP intranet deployments, breaking the double-submit CSRF pair and 403-ing every unsafe request. --- cmd/dashboard/controller/csrf.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/cmd/dashboard/controller/csrf.go b/cmd/dashboard/controller/csrf.go index 53c22d25..e5792c38 100644 --- a/cmd/dashboard/controller/csrf.go +++ b/cmd/dashboard/controller/csrf.go @@ -72,8 +72,13 @@ func setCSRFCookie(c *gin.Context) { if token == "" { return } + // Secure is set only when the request arrives over HTTPS, mirroring + // writeOauth2StateCookie. On plain HTTP (e.g. intranet deployments) a + // Secure cookie would be dropped by the browser, breaking the + // double-submit pair, so we must not force it unconditionally. + secure := c.Request.URL.Scheme == "https" || c.Request.TLS != nil c.SetSameSite(http.SameSiteStrictMode) - c.SetCookie(csrfCookieName, token, 0, "/", "", false, false) + c.SetCookie(csrfCookieName, token, 0, "/", "", secure, false) } const (