From 3a2294f4faf3184057e2e74027e8b9a45fac12de Mon Sep 17 00:00:00 2001 From: Michael Barz Date: Thu, 11 Apr 2024 09:04:54 +0000 Subject: [PATCH] Automated changelog update [skip ci] --- CHANGELOG.md | 35 +++++++++++++++++++---------------- 1 file changed, 19 insertions(+), 16 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2e4becc88..101254319 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -42,13 +42,31 @@ The following sections list the changes for 5.0.1. ## Summary +* Bugfix - Make IDP cookies same site strict: [#8716](https://github.com/owncloud/ocis/pull/8716) * Bugfix - Update reva to v2.19.4: [#8781](https://github.com/owncloud/ocis/pull/8781) * Bugfix - Fix restarting of postprocessing: [#8782](https://github.com/owncloud/ocis/pull/8782) * Bugfix - Fix the create personal space cache: [#8799](https://github.com/owncloud/ocis/pull/8799) -* Enhancement - Make IDP cookies same site strict: [#8716](https://github.com/owncloud/ocis/pull/8716) ## Details +* Bugfix - Make IDP cookies same site strict: [#8716](https://github.com/owncloud/ocis/pull/8716) + + To enhance the security of our application and prevent Cross-Site Request + Forgery (CSRF) attacks, we have updated the SameSite attribute of the build in + Identity Provider (IDP) cookies to Strict. + + This change restricts the browser from sending these cookies with any cross-site + requests, thereby limiting the exposure of the user's session to potential + threats. + + This update does not impact the existing functionality of the application but + provides an additional layer of security where needed. + + This only affects cookies set by the built-in IDP. Production systems should not + be affected. + + https://github.com/owncloud/ocis/pull/8716 + * Bugfix - Update reva to v2.19.4: [#8781](https://github.com/owncloud/ocis/pull/8781) We updated reva to v2.19.4 @@ -81,21 +99,6 @@ The following sections list the changes for 5.0.1. https://github.com/owncloud/ocis/pull/8799 -* Enhancement - Make IDP cookies same site strict: [#8716](https://github.com/owncloud/ocis/pull/8716) - - To enhance the security of our application and prevent Cross-Site Request - Forgery (CSRF) attacks, we have updated the SameSite attribute of the build in - Identity Provider (IDP) cookies to Strict. - - This change restricts the browser from sending these cookies with any cross-site - requests, thereby limiting the exposure of the user's session to potential - threats. - - This update does not impact the existing functionality of the application but - provides an additional layer of security where needed. - - https://github.com/owncloud/ocis/pull/8716 - # Changelog for [5.0.0] (2024-03-18) The following sections list the changes for 5.0.0.