SameSite attribute not set to 'lax' or 'strict' for auth cookies (ZAP finding)

[sshedmake]

Description

RapiDAST/ZAP security scan against RHDH 1.9.4 (Backstage 1.45.3) reports that the SameSite attribute is not set to lax or strict for auth cookies.

This was previously raised upstream in backstage/backstage#28162 but was closed as stale without a fix.

Affected cookies

• refresh-token and granted-scope cookies set in plugins/auth-node/src/oauth/OAuthCookieManager.ts
• backstage-auth cookie set in packages/backend-defaults/src/entrypoints/httpAuth/httpAuthServiceFactory.ts — currently hardcoded to sameSite: 'none'

Environment

• RHDH Version: 1.9.4
• Backstage Version: 1.45.3
• Scanner: RapiDAST / ZAP

Expected behavior

Auth cookies should set SameSite=Lax (or Strict when app and auth backend share the same origin) to mitigate CSRF attacks.

Suggested fix

Apply the fix in the Express configuration, e.g.:

// packages/backend/src/index.ts or similar
app.use(session({
  cookie: { sameSite: 'lax', secure: true }
}));

[github-actions]

This issue is stale because it has been open 30 days with no activity. This project switched to Jira at https://issues.redhat.com/projects/RHIDP/ for issue tracking. If this issues is still relevant, please reopen it there.