From 7f2f9b569445775730e4e9730e33d099edfe75bf Mon Sep 17 00:00:00 2001 From: Rodrigo Lopez Date: Tue, 25 Aug 2026 19:52:23 +0000 Subject: [PATCH 1/2] fix: set the session cookie SameSite policy in the default configuration The shipped configuration served the dashboard over TLS but set no SameSite attribute on the session cookie. Lax blocks the cross-site POST that the attribute is meant to stop, while keeping inbound links and SAML working; Strict would drop the cookie on a link from an email, a report or a ticket. The value also applies to the Wazuh server API cookies, which mirror it. Issue: https://github.com/wazuh/wazuh-dashboard/issues/1520 Signed-off-by: Rodrigo Lopez --- config/opensearch_dashboards.prod.yml | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/config/opensearch_dashboards.prod.yml b/config/opensearch_dashboards.prod.yml index 2250915e3e64..d5db89410c53 100644 --- a/config/opensearch_dashboards.prod.yml +++ b/config/opensearch_dashboards.prod.yml @@ -4,19 +4,28 @@ opensearch.hosts: https://localhost:9200 opensearch.ssl.verificationMode: certificate #opensearch.username: #opensearch.password: -opensearch.requestHeadersAllowlist: ["securitytenant","Authorization"] +opensearch.requestHeadersAllowlist: ['securitytenant', 'Authorization'] opensearch_security.multitenancy.enabled: false -opensearch_security.readonly_mode.roles: ["kibana_read_only"] +opensearch_security.readonly_mode.roles: ['kibana_read_only'] server.ssl.enabled: true -server.ssl.key: "/etc/wazuh-dashboard/certs/dashboard-key.pem" -server.ssl.certificate: "/etc/wazuh-dashboard/certs/dashboard.pem" -opensearch.ssl.certificateAuthorities: ["/etc/wazuh-dashboard/certs/root-ca.pem"] +server.ssl.key: '/etc/wazuh-dashboard/certs/dashboard-key.pem' +server.ssl.certificate: '/etc/wazuh-dashboard/certs/dashboard.pem' +opensearch.ssl.certificateAuthorities: ['/etc/wazuh-dashboard/certs/root-ca.pem'] uiSettings.overrides.defaultRoute: /app/wz-home # Session expiration settings opensearch_security.cookie.ttl: 900000 opensearch_security.session.ttl: 900000 opensearch_security.session.keepalive: true +# HTTP hardening +# isSameSite applies to the platform session cookie (security_authentication) +# and to the Wazuh server API cookies (wz-token, wz-user, wz-api). +# Use None only when embedding the dashboard in a cross-origin iframe; None +# requires HTTPS. The Secure flag is derived from the server protocol and needs +# no setting here; set opensearch_security.cookie.secure explicitly only when a +# reverse proxy terminates TLS in front of the dashboard. +opensearch_security.cookie.isSameSite: Lax + # Define the Wazuh server hosts wazuh_core.hosts: default: From 2ff2cef24b9211a538d79da5433c6b456cd75830 Mon Sep 17 00:00:00 2001 From: Rodrigo Lopez Date: Tue, 25 Aug 2026 20:47:13 +0000 Subject: [PATCH 2/2] docs: add the CHANGELOG entry for the session cookie policy Issue: https://github.com/wazuh/wazuh-dashboard/issues/1520 Signed-off-by: Rodrigo Lopez --- CHANGELOG.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 1587b2d622d1..b0cfedba0a46 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -14,11 +14,12 @@ ### Fixed -| Issue | Comment | -| ----------------------------------------------------------- | -------------------------------------------------------------------------------------------- | -| [#1276](https://github.com/wazuh/wazuh-dashboard/pull/1276) | Fixed health check padding styles | -| [#1285](https://github.com/wazuh/wazuh-dashboard/pull/1285) | Sanitized redirect path to prevent open redirect | -| [#1400](https://github.com/wazuh/wazuh-dashboard/pull/1400) | Prevent infinite remount loop when navigating from an app before its bundle finishes loading | +| Issue | Comment | +| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | +| [#1520](https://github.com/wazuh/wazuh-dashboard/issues/1520) | Set the session cookie `SameSite` policy in the default configuration file | +| [#1276](https://github.com/wazuh/wazuh-dashboard/pull/1276) | Fixed health check padding styles | +| [#1285](https://github.com/wazuh/wazuh-dashboard/pull/1285) | Sanitized redirect path to prevent open redirect | +| [#1400](https://github.com/wazuh/wazuh-dashboard/pull/1400) | Prevent infinite remount loop when navigating from an app before its bundle finishes loading | ### Removed