Cookie related security considerations for solid storage (RS) implementations
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 563
- Forks
- 108
- Avg merge
- 4d 13h
- Merged PRs (30d)
- 3
Description
Yesterday during authentication call we noticed need to capture security considerations related to use of cookies in solid storage implementations. I'll capture initial thoughts and we can fill in the rest in following comments.
- Cookie based access should be restricted to read operations, write (including append) should employ app using access tokens.
- Cookie should be set with
SameSite=Laxwhich browsers make new default. This would prevent third party applications to use cookie instead of access token.
Above considerations relate to avoiding clients circumventing client specific restrictions by using cookie (if available) instead of access token.
@acoburn has some implementation experience including exploration of setting client identifier in a cookie etc.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the specification sections covering Solid storage authentication and cookie-based access. Review the two listed considerations, the authentication-call context, and the referenced implementation experience, then document an agreed set of security requirements and clarify how read, write, append, access-token, SameSite, and client-identifier behavior should be handled.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100