console error how to set SameSite attribute - wordpress

I'm getting the following msgs in my console. How do I fix these?
A cookie associated with a cross-site resource at http://widgets.wp.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at http://wp.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at http://cloudflare.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at http://www.facebook.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at https://facebook.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at http://wordpress.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at https://wordpress.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at http://support.wordpress.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at https://public-api.wordpress.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.
A cookie associated with a cross-site resource at http://public-api.wordpress.com/ was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

this is just a warning message about an upcoming update/ change and Chrome spreads the word about it. Cookies that match the domain of the current site are referred to as first-party cookies. Cookies from domains other than the current domain are referred to as third-party cookies.
CSRF attacks: cookies are attached to any request. For example, if you visit bad.domain.com then a cookie from that domain can trigger requests to your-site.domain.com. Your browser will happily attach the associated cookies. If your site doesn`t validate those requests then a cookie from bad.domain.com could roll out actions like adding content or even more stuff with the rights of your logged-in user.
I think you can`t do anything about it because the cookies are set by these sites.
Regards Tom

Related

How can I add sameSite=None attribute header for all cookies in WordPress?

I have an e-commerce Ionic 5 Application connected with the WordPress website.
I get an issue in chrome and safari browsers that block all cookies that not set the SameSite attribute.
this is the message from chrome:
Indicate whether to send a cookie in a cross-site request by specifying its SameSite attribute
Because a cookie's SameSite attribute was not set or is invalid, it defaults to SameSite=Lax, which prevents the cookie from being sent in a cross-site request. This behavior protects user data from accidentally leaking to third parties and cross-site request forgery.
Resolve this issue by updating the attributes of the cookie:
Specify SameSite=None and Secure if the cookie should be sent in cross-site requests. This enables third-party use.
Specify SameSite=Strict or SameSite=Lax if the cookie should not be sent in cross-site requests
Screenshoot
from this issue, the application in iOS not able to (add to cart) and it always shows empty.
Any Help?

#angular/google-maps not working in production

I have an app written in angular 8. When I run locally the map is working, but when I test the same data on production it is going grey and does not work.
Local:
Working locally map
Production:
Empty map in production
I've set no application restrictions and still, the problem exists.
#Edit 1: In the console there are no errors, but only warnings:
A cookie associated with a cross-site resource at http://google.com/ was set without the `SameSite` attribute.
A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`.
You can review cookies in developer tools under Application>Storage>Cookies and see more details at
https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

Can a user see the JWT when making the http request?

I'm making http request from React to our API for authentication. I'm using fetch to make the requests.
My question is, can a user go to the network tab in chrome dev tools, find the request, and see their own token?
It depends.
Normally, user can see all request headers in the HTTP request, in Network panel of Chrome dev tool.
However, after Chrome 67, a new feature named "Site isolation" was introduced, and enabled by default. As a result:
In Chrome's DevTools, cookies and other request headers are not shown in the network panel for cross-site subresource requests.
That is, if JWT token is transferred by cookie in a subdomain site, and the domain of JWT-cookie is wildcard, it will not be displayed in Network panel.
Here is an example. cookie token's domain is .miaotest.com, and it is used in HTTP request to site cshao.miaotest.com. While this cookie is transferred to backend successfully, you won't see it in "Request Headers" part in dev tool.
Cookie token's information in "Application" panel:
Cookie token is sent but not displayed in Network panel:
Please note the "Site isolation" feature can be disabled by visiting chrome://flags/#site-isolation-trial-opt-out in Chrome.
Yes, he can see the whole request including all request headers.

Why are "secure" cookies insecure?

The MDN docs on HTTP cookies state:
A secure cookie is only sent to the server with an encrypted request over the HTTPS protocol. Even with Secure, sensitive information should never be stored in cookies, as they are inherently insecure and this flag can't offer real protection.
HTTPS requests have their request bodies and all of their headers encrypted with TLS, including the Set-Cookie: response header and the Cookie: request header. This should prevent third parties from reading or tampering with the cookie values.
So why are cookies "inherently insecure"? (Perhaps Mozilla is thinking of someone with access to the user's computer being able to inspect their cookies?)
Why are cookies "inherently insecure"?
The biggest problem of cookie is: it is stored in user's computer, which leads to many possibilities. The server lost control of the cookie's privacy once it is sent to client. As the cookie data is stored in user's computer, the data can be leaked when:
Vulnerability in operating system is exploited by attacker.
Vulnerability in user-agent is exploited by attacker.
Browser extension can get permission to read cookies (e.g. Chrome). Yes, a notification will be displayed to user, but a lot of people just ignore the alert and click "Yes".
Cookie can be inspected in browser dev tool, by another people.
More...
For secure flag, if you send sensitive information in secure cookie to browser, there are still security concerns:
As long as httpOnly flag is not set, all malicious script can read that cookie, and send the information to any server.
If domain setting is not correct, you may leak that sensitive cookie to some interfaces. For example, if the secure cookie's domain is /, then all backend API would receive the sensitive data, which may not be what you want.

Check cookie enabled or disabled in an httpModule in the first request

Is there any method to find browser cookie enabled or disabled in an httpModule.
We are using HttpContext.Current.Request.Headers[“Cookie”] to check whether cookie enabled or disabled.
But in the initial request it is always showing null value in both cases ie if either cookie enabled or disabled.
I am looking for a method to check browser cookie enabled or disabled in the first request
You're checking not for cookies being enabled or disabled but for whether there are some cookies set.
The only way to check if the cookies are enabled is to try to set some cookies, and on the second request from the client to check if they send you these cookies in their request.
This is impossible to check whether the cookies are enabled in the browser on the first request from the client. Anyway, most cases when the cookies won't work is when the browser configured to silently ignore your cookies, and of course you cannot detect whether it is ignoring your cookies or not without trying to set some cookies.

Resources