Handling SameSite=None in openresty/Kong

cookie_maker.lua

local ShouldSendSameSiteNone = require "kong.http.should_send_samesite_none"

local CookieMaker = {}

local FORMAT = "!%a, %d-%b-%Y %X GMT"

local function format_date(expires)
    return os.date(FORMAT, expires)
end

-- expires Expiration time in number of seconds since Unix start time (1970)
-- non Cookie parameter: user_agent - used to define samesite value
-- luacheck: max cyclomatic complexity 13
function CookieMaker.make_cookie(cookie_data)
    assert(type(cookie_data) == "table", "cookie_data must be a table")
    assert(cookie_data.user_agent == nil or type(cookie_data.user_agent) == "string", "cookie_data.user_agent must be a nil or a string")
    assert(type(cookie_data.name) == "string", "cookie_data.name must be a string")
    assert(type(cookie_data.value) == "string", "cookie_data.value must be a string")
    assert(cookie_data.expire == nil or type(cookie_data.expires) == "number", "cookie_data.expires must be a nil or a number")

    local cookie_string = ""
    cookie_string = cookie_string .. cookie_data.name .. "=" .. cookie_data.value

    if cookie_data.path then
        cookie_string = cookie_string .. "; Path=" .. cookie_data.path
    else
        cookie_string = cookie_string .. "; Path=/"
    end

    if cookie_data.domain then
        cookie_string = cookie_string .. "; Domain=" .. cookie_data.domain
    end

    if cookie_data.expires ~= nil and cookie_data.expires >= 0 then
        cookie_string  = cookie_string .. "; Expires=" .. format_date(cookie_data.expires)
    end

    if cookie_data.secure then
        cookie_string  = cookie_string .. "; Secure"
    end

    if cookie_data.httponly then
        cookie_string  = cookie_string .. "; HttpOnly"
    end

    -- the default for a null httpRequest or User-Agent header is to set the SameSite attribute
    if cookie_data.user_agent == nil or ShouldSendSameSiteNone.shouldSendSameSiteNone(cookie_data.user_agent) then
        if cookie_data.samesite ~= nil then             -- can be for example: Strict,Lax, None
            cookie_string = cookie_string .. "; SameSite=" .. cookie_data.samesite
        else
            -- Prior to Chrome 80 if the SameSite attribute was omitted from a cookie,
            -- it was defaulted to "None" by the browser. This is changing and until we
            -- evaluate all places where we set cookies, we need to keep this
            -- default as a stopgap solution because Chrome 80 is fast upon us
            -- and is updating the default to "Lax".
            -- The change to the default breaks a couple workflows including generating
            -- a lima ticket in the lima chrome extension and third party redistributors
            -- being able to authenticate to factset from within an iframe.
            cookie_string = cookie_string .. "; SameSite=None"
        end
    end

    return cookie_string
end

return CookieMaker

should_send_samesite_none.lua

local ShouldSendSameSiteNone = {}

--------------------------------------------------------------------------------
-- A Lua implementation of https://www.chromium.org/updates/same-site/incompatible-clients
-- Don�t send `SameSite=None` to known incompatible clients.

-- Lua pattern matching of the user-agent string.
local function isIosVersion(major, useragent)
    local pattern = "%(iP.+; CPU .*OS (%d+)[%d_]*.*%) AppleWebKit/"
    local version = string.match(useragent, pattern)
    return version == tostring(major)
end

local function isMacosxVersion(major, minor, useragent)
    local pattern = "%(Macintosh;.*Mac OS X (%d+)_(%d+)[_%d]*.*%) AppleWebKit/"
    local _maj, _min = string.match(useragent, pattern)
    return tostring(major) == _maj and tostring(minor) == _min
end

local function isMacEmbeddedBrowser(useragent)
    local pattern = "^Mozilla/[%.%d]+ %(Macintosh;.*Mac OS X [_%d]+%) AppleWebKit/[%.%d]+ %(KHTML, like Gecko%)$"
    return string.match(useragent, pattern)
end

local function isChromiumBased(useragent)
    return string.match(useragent, "Chrome") or string.match(useragent, "Chromium")
end

local function isSafari(useragent)
    local pattern = "Version/.* Safari/"
    return string.match(useragent, pattern) and not isChromiumBased(useragent)
end

local function isChromiumVersionAtLeast(major, useragent)
    local pattern = "Chrom[^ /]+/(%d+)[%.%d]* "
    local _version = tonumber(string.match(useragent, pattern))

    if _version then
        return _version >= major
    else
        return false
    end
end

local function isUcBrowser(useragent)
    local pattern = "UCBrowser/"
    return string.match(useragent, pattern)
end

local function isUcBrowserVersionAtLeast(major, minor, build, useragent)
    local pattern = "UCBrowser/(%d+)%.(%d+)%.(%d+)[%.%d]* "
    local _major, _minor, _build = string.match(useragent, pattern)

    if not _major or not _minor or not _build then
        return false
    end

    if _major ~= tostring(major) then
        return tonumber(_major) > major
    end

    if _minor ~= tostring(minor) then
        return tonumber(_minor) > minor
    end

    return tonumber(_build) >= build
end

local function hasWebKitSameSiteBug(useragent)
    return isIosVersion(12, useragent) or
        (isMacosxVersion(10, 14, useragent) and
            (isSafari(useragent) or isMacEmbeddedBrowser(useragent)))
end

local function dropsUnrecognizedSameSiteCookies(useragent)
    if isUcBrowser(useragent) then
        return not isUcBrowserVersionAtLeast(12, 13, 2, useragent)
    end

    return isChromiumBased(useragent) and not
        isChromiumVersionAtLeast(67, useragent)
end

local function isSameSiteNoneIncompatible(useragent)
    return hasWebKitSameSiteBug(useragent) or
        dropsUnrecognizedSameSiteCookies(useragent)
end

function ShouldSendSameSiteNone.shouldSendSameSiteNone(useragent)
    return not isSameSiteNoneIncompatible(useragent)
end

return ShouldSendSameSiteNone