Restrict cookies to same-site requests by default

liberapay/main.py

@@ -171,6 +171,14 @@ def _assert(x):
 ]
 
 
+# Monkey patch python's stdlib
+# ============================
+
+from six.moves.http_cookies import Morsel
+
+Morsel._reserved[str('samesite')] = str('SameSite')
+
+
 # Monkey patch aspen and pando
 # ============================
 

liberapay/utils/__init__.py

@@ -286,7 +286,7 @@ def ensure_str(s):
     return s.decode('ascii') if isinstance(s, bytes) else s.encode('ascii')
 
 
-def set_cookie(cookies, key, value, expires=None, httponly=True, path='/'):
+def set_cookie(cookies, key, value, expires=None, httponly=True, path='/', samesite='lax'):
     key = ensure_str(key)
     cookies[key] = ensure_str(value)
     cookie = cookies[key]
@@ -300,6 +300,8 @@ def set_cookie(cookies, key, value, expires=None, httponly=True, path='/'):
         cookie[str('httponly')] = True
     if path:
         cookie[str('path')] = ensure_str(path)
+    if samesite:
+        cookie[str('samesite')] = ensure_str(samesite)
     if website.cookie_domain:
         cookie[str('domain')] = ensure_str(website.cookie_domain)
     if website.canonical_scheme == 'https':

tests/py/test_state_chain.py

@@ -94,6 +94,7 @@ def test_csrf_cookie_properties(self):
         assert cookie[str('expires')][-4:] == str(' GMT')
         assert cookie[str('path')] == str('/')
         assert cookie[str('secure')] is True
+        assert cookie[str('samesite')] == str('lax')
 
 
 class Tests2(Harness):