Abandon cookie as session storage for v2.0.0

[peppelinux]

Due to the latest cookie restrictions made by modern web browser, eg: samesite cookie, I'm wondering if it were time to rewrite entirely the session backend used to store SAML2 requests.

Here we have how djangosaml2 handles the persistence, in saml_session cookie:

djangosaml2/djangosaml2/cache.py

Line 71 in 57ad2ba

class IdentityCache(Cache):

I'd abadon cookie storage and move to a DB storage (RDBMS or NoSQL). The SAML2 requests alwasy come with an ID and this will be involved in lookup. This will also introduce a stronger replay attack prevention strategy, based on parsing and matching the SAML2 request on all those already stored, nothing else.

In each stored saml2 request there will be a link to user that have been authenticated with it and also the SAML2 response as evidence of that.
They would have an expiration time equal to the corrisponding SAML2 NotOnOrAfter condition and it would be periodically purged (scheduled or NoSQL strategy like Redis TTL).

see also
https://github.com/WICG/WebID/blob/main/cookies.md

[rvanlaar]

Hey,
We're experiencing problems due to the cache being tied to cookies. I.e. sometimes the session cookie goes AWOL between us setting them and the user coming back with the credentials.

What kind of help do you want?

[peppelinux]

in which conditions the AWOL occurs?

[rvanlaar]

in which conditions the AWOL occurs?

We haven't seen a common cause. It happens on all browsers on all platforms except of course the ones we test with.

Regarding help: This ticket has the label 'help wanted'. What kind of help do you want?

[peppelinux]

Do you have configured the samesite cookie?
Which hostname do you use for tests (that work)?

Help wanted -> tests and answers are needed

[rvanlaar]

set-cookie: saml_session=LONGSTRING; HttpOnly; Path=/; SameSite=None; Secure

A lot of people are able to login. It's only some whom get the error 'UnsolicitedResponse'.

edit removed '<' '>' around LONGSTRING to get it to show.

[peppelinux]

it's something up to the users' user-agent

please ask to them the user-agent and its version

[rvanlaar]

Could you elaborate?
Are you saying it's the user-agent? Or that it's due to the browser used?

[peppelinux]

user-agent, I mean the web browser used by users