Merge r1873762, r1881263 from trunk:

add SameSite to RewriteRule ... ... [CO]

samesite: fix check for 0, add "false" alternative.

Submitted by: covener
Reviewed by: rpluem, gbechis, jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1883536 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index de5b149284ded1ae800af96f055054304af80c3f..664205f98ba9d26919bf6b8dba81a6cdb9121867 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.47
 
+  *) mod_rewrite: Extend the [CO] (cookie) flag of RewriteRule to accept a
+     SameSite attribute. [Eric Covener]
+
   *) mod_proxy: Add proxy check_trans hook.  This allows proxy 
      modules to decline request handling at early stage.
 

diff --git a/STATUS b/STATUS
index 01b633a6fbc225f4f9ff05073dcc2969fcc91cd5..cbd7b39883b3a1f3f8152f8d5bd1716fe541b41f 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -145,16 +145,6 @@ PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
     Backport version for 2.4.x of patch:
      +1: jailletc36, giovanni, ylavic
 
-  *) mod_rewrite: Extend the [CO] (cookie) flag of RewriteRule to accept a
-     SameSite attribute.
-     Trunk version of patch:
-        https://svn.apache.org/r1873762
-        https://svn.apache.org/r1881263
-     Backport version for 2.4.x of patch:
-      Trunk version of patch works
-      svn merge -c 1873762,1881263 ^/httpd/httpd/trunk .
-     +1: rpluem, gbechis, jim
-
   *) mpm_event: kill connections in keepalive state only when there is no more
      workers available, not when the maximum number of connections is reached,
      restoring prior to 2.4.30 behaviour.

diff --git a/docs/manual/mod/mod_rewrite.xml b/docs/manual/mod/mod_rewrite.xml
index 9c912bc8c4e5432262063c046ff45359f751f741..c7bcd310ed694bd31896249bbde1d5b3c8a6f34b 100644 (file)
--- a/docs/manual/mod/mod_rewrite.xml
+++ b/docs/manual/mod/mod_rewrite.xml
@@ -1336,7 +1336,7 @@ cannot use <code>$N</code> in the substitution string!
     <tr>
         <td>cookie|CO=<em>NAME</em>:<em>VAL</em></td>
         <td>Sets a cookie in the client browser. Full syntax is:
-        CO=<em>NAME</em>:<em>VAL</em>:<em>domain</em>[:<em>lifetime</em>[:<em>path</em>[:<em>secure</em>[:<em>httponly</em>]]]] <em><a href="../rewrite/flags.html#flag_co">details ...</a></em>
+        CO=<em>NAME</em>:<em>VAL</em>:<em>domain</em>[:<em>lifetime</em>[:<em>path</em>[:<em>secure</em>[:<em>httponly</em>[<em>samesite</em>]]]]] <em><a href="../rewrite/flags.html#flag_co">details ...</a></em>
         </td>
     </tr>
     <tr>

diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml
index 8f5ac3ec3285b0ae23942d0388bdb9899c58c9ed..54f76c10dd2c13b4da6b51248adb5a81d3aa182a 100644 (file)
--- a/docs/manual/rewrite/flags.xml
+++ b/docs/manual/rewrite/flags.xml
@@ -134,14 +134,14 @@ skipped.</p>
 <section id="flag_co"><title>CO|cookie</title>
 <p>The [CO], or [cookie] flag, allows you to set a cookie when a
 particular <directive module="mod_rewrite">RewriteRule</directive>
-matches. The argument consists of three required fields and four optional
+matches. The argument consists of three required fields and five optional
 fields.</p>
 
 <p>The full syntax for the flag, including all attributes, is as
 follows:</p>
 
 <example>
-[CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly]
+[CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite]
 </example>
 
 <p>If a literal ':' character is needed in any of the cookie fields, an 
@@ -150,7 +150,7 @@ alternate syntax is available.  To opt-in to the alternate syntax, the cookie
 specified as ';'.</p>
 
 <example>
-[CO=;NAME;VALUE:MOREVALUE;DOMAIN;lifetime;path;secure;httponly]
+[CO=;NAME;VALUE:MOREVALUE;DOMAIN;lifetime;path;secure;httponly;samesite]
 </example>
 
 <p>You must declare a name, a value, and a domain for the cookie to be set.</p>
@@ -191,6 +191,12 @@ connections.</dd>
 which means that the cookie is inaccessible to JavaScript code on
 browsers that support this feature.</dd>
 </dl>
+<dt>samesite</dt>
+<dd>If set to anything other than <code>false</code> or <code>0</code>, the <code>SameSite</code>
+attribute is set to the specified value.  Typical values are <code>None</code>,
+<code>Lax</code>, and <code>Strict</code>.Available in 2.5.1 and later.</dd>
+</dl>
+
 
 <p>Consider this example:</p>
 

diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index 4c438b9fe03e0d83482fa529d3ce4cbc6a454d22..9a38fe9c622e4a757220aa866969b2aa7d176adf 100644 (file)
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -2538,6 +2538,7 @@ static void add_cookie(request_rec *r, char *s)
     char *path;
     char *secure;
     char *httponly;
+    char *samesite;
 
     char *tok_cntx;
     char *cookie;
@@ -2572,6 +2573,7 @@ static void add_cookie(request_rec *r, char *s)
             path = expires ? apr_strtok(NULL, sep, &tok_cntx) : NULL;
             secure = path ? apr_strtok(NULL, sep, &tok_cntx) : NULL;
             httponly = secure ? apr_strtok(NULL, sep, &tok_cntx) : NULL;
+            samesite = httponly ? apr_strtok(NULL, sep, &tok_cntx) : NULL;
 
             if (expires) {
                 apr_time_exp_t tms;
@@ -2611,6 +2613,11 @@ static void add_cookie(request_rec *r, char *s)
                                   "; HttpOnly" : NULL,
                                  NULL);
 
+            if (samesite && strcmp(samesite, "0") && ap_cstr_casecmp(samesite,"false")) { 
+                cookie = apr_pstrcat(rmain->pool, cookie, "; SameSite=", 
+                                     samesite, NULL);
+            }
+
             apr_table_addn(rmain->err_headers_out, "Set-Cookie", cookie);
             apr_pool_userdata_set("set", notename, NULL, rmain->pool);
             rewritelog((rmain, 5, NULL, "setting cookie '%s'", cookie));