MIME-Version: 1.0
From: Rahul Shirsat <rahul.shirsat@enterprisedb.com>
Date: Wed, 25 Nov 2020 16:07:12 +0530
Message-ID: 
 <CAKtn9dNqZqKbOuwaE5Y94+_WG=NqTh+=oj1vYvdcbq7501b_NQ@mail.gmail.com>
Subject: SameSite issues in Safari Browser (reference #RM5975)
To: pgadmin-hackers <pgadmin-hackers@postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000bb36af05b4ec04f4"
Precedence: bulk

--000000000000bb36af05b4ec04f4
Content-Type: text/plain; charset="UTF-8"

Hi Dave,

Due to SameSite security issues in Safari Browser, some of the pgadmin4
functionality isn't working (mostly the new tab functionality).

The affected Safari Browser versions (marked in red) currently tested upon
are:

   1. v11.1.2
   2. v12.1
   3. v12.1.1
   4. 13.1
   5. 14.0.1

Since v12, Safari have done some security fixes, due to which this issue
has occurred. Strangely, the issue is not reproducible on v13, but
reproducible on its successor i.e. v14

Possible solutions could be:

   1. Reporting this to Safari & raising an RM for tracking purposes.
   2. Suggesting Safari users to make below changes in config.py or
   config_distro for the work around:

*SESSION_COOKIE_SAMESITE = None*

*SESSION_COOKIE_SECURE = True*
(As we aren't going through any cross-site cookie transfer, this can be a
handy option - but still risky..)

I would suggest going with the 1st option or combination of both, but with
caution.

-- 
*Rahul Shirsat*
Software Engineer | EnterpriseDB Corporation.

--000000000000bb36af05b4ec04f4
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Dave,<div><br></div><div>Due to SameSite security issue=
s in Safari=C2=A0Browser, some of the pgadmin4 functionality isn&#39;t work=
ing (mostly the new tab functionality).</div><div><br></div><div>The affect=
ed Safari Browser versions (marked in red) currently tested upon are:</div>=
<div><ol><li>v11.1.2</li><li><font color=3D"#ff0000">v12.1</font></li><li><=
font color=3D"#ff0000">v12.1.1</font></li><li><font color=3D"#000000">13.1<=
/font></li><li><font color=3D"#ff0000">14.0.1</font></li></ol><div>Since v1=
2, Safari have done some security fixes, due to which this issue has occurr=
ed. Strangely, the issue is not reproducible on v13, but reproducible=C2=A0=
on its successor i.e. v14</div></div><div><br></div><div>Possible solutions=
 could be:</div><div><ol><li>Reporting this to Safari &amp; raising an RM f=
or tracking purposes.</li><li>Suggesting Safari users to make below changes=
 in config.py or config_distro for the work around:</li></ol></div><blockqu=
ote style=3D"margin:0 0 0 40px;border:none;padding:0px"><i>SESSION_COOKIE_S=
AMESITE =3D None</i><br><i>SESSION_COOKIE_SECURE =3D True<br></i><br>(As we=
 aren&#39;t going through any cross-site cookie transfer, this can be a han=
dy option - but still risky..)<br><br></blockquote><div>I would suggest goi=
ng with the 1st option or combination of both, but with caution.</div><br><=
div></div><div>-- <br><div dir=3D"ltr" class=3D"gmail_signature" data-smart=
mail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"ltr"><div dir=3D=
"ltr"><div style=3D"color:rgb(0,0,0);font-family:Helvetica;font-size:12px">=
<b style=3D"color:rgb(96,96,97)">Rahul Shirsat</b><br></div><div style=3D"c=
olor:rgb(0,0,0);font-family:Helvetica;font-size:12px"><font color=3D"#5f5e5=
f">Software Engineer=C2=A0|=C2=A0EnterpriseDB=C2=A0Corporation.</font></div=
></div></div></div></div></div></div></div>

--000000000000bb36af05b4ec04f4--