Dashboard hardening: session cookie missing Secure/SameSite and no HSTS header

[rodrigofez]

Description

The default configuration serves the dashboard with TLS, but it did not set a SameSite value for the session cookie. A browser thus sends the cookie with a request from a different web site.

A security test of a 5.0 system found this problem.

Related issue: #1520

Proposed Changes

Add one line to config/opensearch_dashboards.prod.yml:

opensearch_security.cookie.isSameSite: Lax

The value Lax stops a cross-site POST request. Normal links continue to operate.

The value Strict is not used. Strict removes the cookie when a user opens a link from an e-mail, a report or a ticket. Strict also stops the SAML login.

This value applies to the platform session cookie and to the Wazuh server API cookies. The Wazuh plugin reads the same setting.

The Secure flag needs no line here. A related pull request calculates it from the server protocol.

The pull request also changes five lines that are not related. The Prettier check of the repository refuses the file with the current quotation marks. The change is from " to ' only. The values do not change.

Results and Evidence

Test on a development system with HTTPS and this value:

security_authentication=<...>; Secure; HttpOnly; SameSite=Strict; Path=/

The login is complete and the session continues.

Artifacts Affected

The default configuration file /etc/wazuh-dashboard/opensearch_dashboards.yml.

Configuration Changes

One new line in the default configuration file. The package does not replace an existing file, thus an operator with an installed system must add the line manually. The upgrade instructions in the wazuh-dashboard-plugins repository give this step.

Documentation Updates

CHANGELOG.md — a new line in the "Fixed" section.

The reference documents are in the wazuh-dashboard-plugins repository. See the related pull request.

Tests Introduced

None. This pull request changes only a configuration file.

Review Checklist

• Code changes reviewed
• Relevant evidence provided
• Configuration changes documented
• Meets requirements and/or definition of done
• PR is linked to the relevant issue(s)
• No unresolved dependencies with other issues

Note: This pull request needs the two related pull requests. See the issue.

[rodrigofez]

Closed without merge.

A SAML login test showed that a SameSite value on the session cookie breaks the login. The identity provider posts the response to /_opendistro/_security/saml/acs from its own site, and a browser does not send the cookie with a cross-site POST. The callback then answers 400 Invalid requestId.

Test on the -saml development environment, same stack and same browser, only this line different:

opensearch_security.cookie.isSameSite	Result of the callback
Lax	400 Invalid requestId — the login fails
not set	302 — the dashboard opens

SameSite also gives no protection here. Each request that changes data needs the osd-xsrf header, and CORS is disabled, thus a different web site cannot make such a request. The only routes without the header check are the SAML routes, and those are the routes that SameSite breaks.

The other corrections for the issue stay in wazuh/wazuh-dashboard-plugins#9041 and wazuh/wazuh-security-dashboards-plugin#718.