Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kiCFd-0005LD-AX for pgadmin-hackers@arkaria.postgresql.org; Thu, 26 Nov 2020 08:03:37 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kiCFc-0007tf-4e for pgadmin-hackers@arkaria.postgresql.org; Thu, 26 Nov 2020 08:03:36 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kiCFb-0007tY-Os for pgadmin-hackers@lists.postgresql.org; Thu, 26 Nov 2020 08:03:35 +0000 Received: from mail-qt1-x82d.google.com ([2607:f8b0:4864:20::82d]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1kiCFY-0002jN-QE for pgadmin-hackers@postgresql.org; Thu, 26 Nov 2020 08:03:35 +0000 Received: by mail-qt1-x82d.google.com with SMTP id m65so582145qte.11 for ; Thu, 26 Nov 2020 00:03:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb-com.20150623.gappssmtp.com; s=20150623; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=IAoK3okBSlGNqs7PDlIdhQDa8nEA7fsTic/Raa02MwU=; b=NGMu5LiD5clWyvkM+lJTtgSewu2pGd1q2RhiuuXufmL/PoogORt+Xu/Kb9d8oUqAEv PfaNNjI+an2XSObnTBlXUmygentJYVcGoEfPe2DLoyF4PvlZkLHBlUVLatZfyLRyByxB dba4TPtsJqD+37VL1RPGYbMcAvSQ29YthM3TsnpKpauY1dnWiMeFxxbDeVHO2HpshBao veslJXYSHIrNoAt2RObBtc5tY8Z/5NZDzBAyQrpAct7G8mqhUpoKQ99nR1cVCI2BIfPQ 0J5ZCQtzv3Wy9zDpk5nRU5StNsC+fhJOkzuT5NfJe77kzD3U67GZWTgoMymHNIN9Nrpa Sp0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=IAoK3okBSlGNqs7PDlIdhQDa8nEA7fsTic/Raa02MwU=; b=q0yLXFVO43qQ0RgefdUcmwpMZFec6XQrblnPKV0WvrFtYnOX1/cMy+KTKlIs0PSp20 FRYXCAk6urq+Z58abmwnhDsjbz1hLm1ATdJzACVHDXocj7rQfutT6RmZR7BJ/5ONFBl6 5hirmGHuq52kDgZ0tEuUoNphbe3BMDC3ao6vK2fVw7hOeFOJkTmsUBpscKmEMGcnyq1m AkynzI8Z1kSY8EL81qMKKt2+NGzL3XzAZ2foSUZp47lDQl/OSe5cScfjnZYUbif3rBtT Q38s4tlRATx85EIVvg2JmCUftwtFlrDM9iEOCvdImbP9F5xeMmLY+B7kfGsER1eb08p4 1A5w== X-Gm-Message-State: AOAM533vhsQqWpkrkIozHrVVzeE/iLMkYMLOBMzB8DW7FQxAY9XWFLtG kQbzG0ekLsXsRdtEQzuAMYiDMtyOObeMup20OAHqrfXd4kd/w64c1Wg4BpU7juFgTpaD5strj9i hZQIil3x6wqoLKZYiUjlO40ploW2royBf1dzymIkmoB3nCtGXj9CGi62RaX8nkxYisxzJGSEl09 wLb5qnaY2QsDQtw1V2VOqMWVu2c3sRPhSX8w6TinUuWdiojlWPkiMsW2r/XQ== X-Google-Smtp-Source: ABdhPJxMp5ASS2rFxCNdp3GNXiV6zVifTq0Pvim8Z0+rXmXUSpBEehp8sozC3wjvyg8d1OCwMv/N7d9XClla9d+Y6Q0= X-Received: by 2002:aed:3b7b:: with SMTP id q56mr1853277qte.377.1606377810275; Thu, 26 Nov 2020 00:03:30 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Rahul Shirsat Date: Thu, 26 Nov 2020 13:32:53 +0530 Message-ID: Subject: Re: SameSite issues in Safari Browser (reference #RM5975) To: Akshay Joshi Cc: pgadmin-hackers Content-Type: multipart/alternative; boundary="000000000000c1c8c705b4fdfa6c" X-CLOUD-SEC-AV-Info: enterprisedb,google_mail,monitor X-CLOUD-SEC-AV-Sent: true X-Gm-Spam: 0 X-Gm-Phishy: 0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --000000000000c1c8c705b4fdfa6c Content-Type: text/plain; charset="UTF-8" Yes Akshay. I think we should go ahead adding this approach in the pgadmin faqs, we would not be fixing this in our code as we don't know when Apple would fix its issue. On Thu, Nov 26, 2020 at 11:27 AM Akshay Joshi wrote: > Hi Rahul > > On Wed, Nov 25, 2020 at 4:07 PM Rahul Shirsat < > rahul.shirsat@enterprisedb.com> wrote: > >> Hi Dave, >> >> Due to SameSite security issues in Safari Browser, some of the pgadmin4 >> functionality isn't working (mostly the new tab functionality). >> >> The affected Safari Browser versions (marked in red) currently tested >> upon are: >> >> 1. v11.1.2 >> 2. v12.1 >> 3. v12.1.1 >> 4. 13.1 >> 5. 14.0.1 >> >> Since v12, Safari have done some security fixes, due to which this issue >> has occurred. Strangely, the issue is not reproducible on v13, but >> reproducible on its successor i.e. v14 >> >> Possible solutions could be: >> >> 1. Reporting this to Safari & raising an RM for tracking purposes. >> 2. Suggesting Safari users to make below changes in config.py or >> config_distro for the work around: >> >> *SESSION_COOKIE_SAMESITE = None* >> >> *SESSION_COOKIE_SECURE = True* >> (As we aren't going through any cross-site cookie transfer, this can be a >> handy option - but still risky..) >> >> I would suggest going with the 1st option or combination of both, but >> with caution. >> > > In my opinion, we should go with both the options, as we have added the > above settings for security purposes. > >> >> -- >> *Rahul Shirsat* >> Software Engineer | EnterpriseDB Corporation. >> > > > -- > *Thanks & Regards* > *Akshay Joshi* > *pgAdmin Hacker | Principal Software Architect* > *EDB Postgres * > > *Mobile: +91 976-788-8246* > -- *Rahul Shirsat* Software Engineer | EnterpriseDB Corporation. --000000000000c1c8c705b4fdfa6c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Yes Akshay.

I think we should go ah= ead adding this approach in the pgadmin faqs, we would not be fixing this i= n our code as we don't know when Apple would fix its issue.
=
On Thu= , Nov 26, 2020 at 11:27 AM Akshay Joshi <akshay.joshi@enterprisedb.com> wrote:
Hi=C2=A0Rahul

On Wed, Nov 25, 2020 at 4:07 PM Rahul Shirsat <rahul.shirsat= @enterprisedb.com> wrote:
Hi Dave,

Due to SameSi= te security issues in Safari=C2=A0Browser, some of the pgadmin4 functionali= ty isn't working (mostly the new tab functionality).

The affected Safari Browser versions (marked in red) currently teste= d upon are:
  1. v11.1.2
  2. v12.1=
  3. v12.1.1
  4. 13.1
  5. 14.0.1
    6. =
Since v12, Safari have done some security fixes, due to which thi= s issue has occurred. Strangely, the issue is not reproducible on v13, but = reproducible=C2=A0on its successor i.e. v14

= Possible solutions could be:
  1. Reporting this to Safari &am= p; raising an RM for tracking purposes.
  2. Suggesting Safari users to = make below changes in config.py or config_distro for the work around:
    3. <= /ol>
SESSION_COOKIE_SAMESITE =3D None
SESSION_COOKIE_SECURE = =3D True

(As we aren't going through any cross-site cookie t= ransfer, this can be a handy option - but still risky..)

I would suggest going with the 1st option or combination of both, bu= t with caution.

=C2=A0 =C2=A0In= my opinion, we should go with both the options, as we have added the above= settings for security purposes.

--
<= div dir=3D"ltr">
Rahul Shirsat
Software Engineer=C2=A0= |=C2=A0EnterpriseDB=C2=A0Corporation.
<= /div>


--
Thank= s & Regards
Akshay Joshi
pgAdmin Hacker | Principal Softw= are Architect
EDB Po= stgres
Mobile: +91 976-788-8246



--
Rahul Shirsat
Software Engineer=C2=A0|=C2=A0EnterpriseDB=C2=A0Corporation.=
--000000000000c1c8c705b4fdfa6c--