Refined Cookie production

Before this commit, logging in over http didn't work anymore due to a new Set-Cookie. After this commit, it works again.

Author: teusbenschop

session/logic.cpp

@@ -166,7 +166,7 @@ bool Session_Logic::attempt_login (std::string user_or_email, const std::string&
     open ();
     set_username (user_or_email);
     m_logged_in = true;
-    std::string cookie = m_webserver_request.session_identifier;
+    const std::string cookie = m_webserver_request.session_identifier;
     Database_Login::setTokens (user_or_email, "", "", "", cookie, touch_enabled_in);
     get_level (true);
     return true;

session/login.cpp

@@ -67,7 +67,7 @@ std::string session_login (Webserver_Request& webserver_request)
   Assets_View view{};
 
   // Form submission handler.
-  if (webserver_request.post_get("submit") != "") {
+  if (webserver_request.post_count("submit")) {
     bool form_is_valid = true;
     const std::string user = webserver_request.post_get("user");
     const std::string pass = webserver_request.post_get("pass");

unittests/http.cpp

@@ -319,10 +319,24 @@ TEST (http, parse_header)
   }
   // Test cookie session.
   {
-    Webserver_Request request{};
-    const bool parsed = http_parse_header ("Cookie: Session=session; foo=bar; extra=clutter", request);
-    EXPECT_TRUE(parsed);
-    EXPECT_EQ(request.session_identifier, "session");
+    {
+      Webserver_Request request{};
+      const bool parsed = http_parse_header ("Cookie: Session=session; foo=bar; extra=clutter", request);
+      EXPECT_TRUE(parsed);
+      EXPECT_EQ(request.session_identifier, "session");
+    }
+    {
+      Webserver_Request request{};
+      const bool parsed = http_parse_header ("Cookie: Session=1d15e82d0cf17d8b2b675ee9a7b8bb2f", request);
+      EXPECT_TRUE(parsed);
+      EXPECT_EQ(request.session_identifier, "1d15e82d0cf17d8b2b675ee9a7b8bb2f");
+    }
+    {
+      Webserver_Request request{};
+      const bool parsed = http_parse_header ("Cookie: Session=a809d7bdf691e86a409db85c9cfe69f2; Path=/; Max-Age=2678400; HttpOnly; SameSite=None; Secure", request);
+      EXPECT_TRUE(parsed);
+      EXPECT_EQ(request.session_identifier, "a809d7bdf691e86a409db85c9cfe69f2");
+    }
   }
   // Test empty line as end of header.
   {

webserver/http.cpp

@@ -243,19 +243,33 @@ void http_assemble_response (Webserver_Request& webserver_request)
     // The Secure attribute is set.
     // It is meant to keep cookie communication limited to encrypted transmission,
     // directing browsers to use cookies only via secure/encrypted connections.
-    // For maximum security, cookies with the Secure attribute should only be set over a secure connection.
+    // Cookies with the Secure attribute should only be set over a secure connection.
+    // If the Secure attribute is set and the connection is over http,
+    // then the browser indicates:
+    // This attempt to set a cookie via a Set-Cookie header was blocked
+    // because it had the "Secure" attribute but was not received over a secure connection.
+    // The result of this is that a user cannot login to Bibledit Cloud over a plain connection.
+    // The localhost binding works because most browsers have special-case code
+    // to treat connections to that host name as "secure", even if they don't use HTTPS.
 
     // The HttpOnly attribute means that the cookie can be accessed by the HTTP API only,
     // and not by for example Javascript running in the browser.
     // This provides extra security.
 
     // The setting "SameSite" is set to "None" to enable cookies while embedded in e.g. NextCloud,
     // which works via an iframe on a different origin.
+    // If set to "None", this only works on a secure connection.
+    // On a plain connection, the browser says:
+    // This attempt to set a cookie via a Set-Cookie header was blocked
+    // because it had the "SameSite=None" attribute but did not have the "Secure" attribute,
+    // which is required in order to use "SameSite=None".
 
     std::string identifier = webserver_request.session_identifier;
     if (identifier.empty ())
       identifier = filter::strings::get_new_random_string ();
-    const std::string cookie = "Session=" + identifier + "; Path=/; Max-Age=2678400; HttpOnly; SameSite=None; Secure";
+    std::string cookie = "Session=" + identifier + "; Path=/; Max-Age=2678400; HttpOnly";
+    if (webserver_request.secure)
+      cookie.append("; SameSite=None; Secure");
     response.push_back ("Set-Cookie: " + cookie);
   }
   if (!webserver_request.header.empty ())