Cookies improvements

* BREAKAGE: Cookies flags in cookie_handler.make_cookie_content now are lowercased by default, they doesn't being correctly loaded by flask and django .set_cookie
* chore: flask_op views _add_cookie generalization
* feat: additional cookie_handler parameter called `flags` to configure whatever cookie flag we desire
* feat: Cookie default flags SameSite, HttpOnly and Secure set to True by default

Author: peppelinux

example/flask_op/views.py

@@ -28,10 +28,9 @@
 
 
 def _add_cookie(resp, cookie_spec):
-    kwargs = {'value': cookie_spec["value"]}
-    for param in ['expires', 'max-age']:
-        if param in cookie_spec:
-            kwargs[param] = cookie_spec[param]
+    kwargs = {k:v
+              for k,v in cookie_spec.items()
+              if k not in ('name',)}
     kwargs["path"] = "/"
     resp.set_cookie(cookie_spec["name"], **kwargs)
 

src/oidcop/cookie_handler.py

@@ -37,6 +37,7 @@ def __init__(
         keys: Optional[dict] = None,
         sign_alg: [str] = "SHA256",
         name: Optional[dict] = None,
+        **kwargs
     ):
 
         if keys:
@@ -77,6 +78,15 @@ def __init__(
         else:
             self.name = name
 
+        self.flags = kwargs.get(
+            'flags',
+            {
+              "samesite": "None",
+              "httponly": True,
+              "secure": True,
+            }
+        )
+
     def _sign_enc_payload(self, payload: str, timestamp: Optional[Union[int, str]] = 0):
         """
         Creates signed and/or encrypted information.
@@ -211,9 +221,12 @@ def make_cookie_content(
         content = {"name": name, "value": _cookie_value}
 
         if max_age == -1:
-            content["Expires"] = "Thu, 01 Jan 1970 00:00:00 GMT;"
+            content["expires"] = "Thu, 01 Jan 1970 00:00:00 GMT;"
         elif max_age:
-            content["Max-Age"] = epoch_in_a_while(seconds=max_age)
+            content["max-age"] = epoch_in_a_while(seconds=max_age)
+
+        for k,v in self.flags.items():
+            content[k] = v
 
         return content
 

src/oidcop/endpoint_context.py

@@ -232,9 +232,10 @@ def __init__(
         self.claims_interface = None
 
     def new_cookie(self, name: str, max_age: Optional[int] = 0, **kwargs):
-        return self.cookie_handler.make_cookie_content(
+        cookie_cont = self.cookie_handler.make_cookie_content(
             name=name, value=json.dumps(kwargs), max_age=max_age
         )
+        return cookie_cont
 
     def set_scopes_handler(self):
         _spec = self.conf.get("scopes_handler")

tests/test_09_cookie_handler.py

@@ -25,15 +25,19 @@ def test_init(self):
     def test_make_cookie_content(self):
         _cookie_info = self.cookie_handler.make_cookie_content("oidcop", "value", "sso")
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value"}
+        assert set(_cookie_info.keys()) == {
+            "name", "value", "samesite", "httponly", "secure"
+        }
         assert len(_cookie_info["value"].split("|")) == 3
 
     def test_make_cookie_content_max_age(self):
         _cookie_info = self.cookie_handler.make_cookie_content(
             "oidcop", "value", "sso", max_age=3600
         )
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value", "Max-Age"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'max-age', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 3
 
     def test_read_cookie_info(self):
@@ -72,15 +76,19 @@ def make_cookie_handler(self):
     def test_make_cookie_content(self):
         _cookie_info = self.cookie_handler.make_cookie_content("oidcop", "value", "sso")
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 4
 
     def test_make_cookie_content_max_age(self):
         _cookie_info = self.cookie_handler.make_cookie_content(
             "oidcop", "value", "sso", max_age=3600
         )
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value", "Max-Age"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'max-age', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 4
 
     def test_read_cookie_info(self):
@@ -118,15 +126,19 @@ def make_cookie_content_handler(self):
     def test_make_cookie_content(self):
         _cookie_info = self.cookie_handler.make_cookie_content("oidcop", "value", "sso")
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 4
 
     def test_make_cookie_content_max_age(self):
         _cookie_info = self.cookie_handler.make_cookie_content(
             "oidcop", "value", "sso", max_age=3600
         )
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value", "Max-Age"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'max-age', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 4
 
     def test_read_cookie_info(self):
@@ -168,15 +180,19 @@ def make_cookie_handler(self):
     def test_make_cookie_content(self):
         _cookie_info = self.cookie_handler.make_cookie_content("oidcop", "value", "sso")
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 4
 
     def test_make_cookie_content_max_age(self):
         _cookie_info = self.cookie_handler.make_cookie_content(
             "oidcop", "value", "sso", max_age=3600
         )
         assert _cookie_info
-        assert set(_cookie_info.keys()) == {"name", "value", "Max-Age"}
+        assert set(_cookie_info.keys()) == {
+            'name', 'value', 'max-age', 'samesite', 'httponly', 'secure'
+        }
         assert len(_cookie_info["value"].split("|")) == 4
 
     def test_read_cookie_info(self):

tests/test_30_oidc_end_session.py

@@ -605,7 +605,7 @@ def test_kill_cookies(self):
         assert set(_names) == {"oidc_op_sman", "oidc_op"}
         _values = [ci["value"] for ci in _info]
         assert set(_values) == {"", ""}
-        _exps = [ci["Expires"] for ci in _info]
+        _exps = [ci["expires"] for ci in _info]
         assert set(_exps) == {
             "Thu, 01 Jan 1970 00:00:00 GMT;",
             "Thu, 01 Jan 1970 00:00:00 GMT;",