From 2cf481d4e6734d28c0ac44091cdd7f3a3bace3c1 Mon Sep 17 00:00:00 2001 From: Lennart <18233294+lennart-k@users.noreply.github.com> Date: Mon, 25 Aug 2025 19:09:24 +0200 Subject: [PATCH 01/11] make session cookie samesite=lax by default --- src/app.rs | 7 ++++++- src/config.rs | 2 ++ src/main.rs | 1 + 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/src/app.rs b/src/app.rs index 80457c3..0f51d85 100644 --- a/src/app.rs +++ b/src/app.rs @@ -38,6 +38,7 @@ pub fn make_app( oidc_config: Option, nextcloud_login_config: NextcloudLoginConfig, dav_push_enabled: bool, + session_cookie_samesite_strict: bool, ) -> Router<()> { let combined_cal_store = Arc::new(CombinedCalendarStore::new( cal_store.clone(), @@ -128,7 +129,11 @@ pub fn make_app( SessionManagerLayer::new(session_store) .with_name("rustical_session") .with_secure(true) - .with_same_site(SameSite::Strict) + .with_same_site(if session_cookie_samesite_strict { + SameSite::Strict + } else { + SameSite::Lax + }) .with_expiry(Expiry::OnInactivity( tower_sessions::cookie::time::Duration::hours(2), )), diff --git a/src/config.rs b/src/config.rs index 0c515c6..4eb8829 100644 --- a/src/config.rs +++ b/src/config.rs @@ -7,6 +7,7 @@ use serde::{Deserialize, Serialize}; pub struct HttpConfig { pub host: String, pub port: u16, + pub session_cookie_samesite_strict: bool, } impl Default for HttpConfig { @@ -14,6 +15,7 @@ impl Default for HttpConfig { Self { host: "0.0.0.0".to_owned(), port: 4000, + session_cookie_samesite_strict: false, } } } diff --git a/src/main.rs b/src/main.rs index 2dd1d2e..b4ceadf 100644 --- a/src/main.rs +++ b/src/main.rs @@ -116,6 +116,7 @@ async fn main() -> Result<()> { config.oidc.clone(), config.nextcloud_login.clone(), config.dav_push.enabled, + config.http.session_cookie_samesite_strict, ); let app = ServiceExt::::into_make_service( NormalizePathLayer::trim_trailing_slash().layer(app), From c648ed315d3fc30996f2ae4b3e1cdb6c9f9fb426 Mon Sep 17 00:00:00 2001 From: Lennart <18233294+lennart-k@users.noreply.github.com> Date: Mon, 25 Aug 2025 19:09:48 +0200 Subject: [PATCH 02/11] version 0.9.1 --- Cargo.lock | 22 +++++++++++----------- Cargo.toml | 2 +- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a5d54aa..54b10d8 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -3040,7 +3040,7 @@ dependencies = [ [[package]] name = "rustical" -version = "0.9.0" +version = "0.9.1" dependencies = [ "anyhow", "argon2", @@ -3083,7 +3083,7 @@ dependencies = [ [[package]] name = "rustical_caldav" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-std", "async-trait", @@ -3123,7 +3123,7 @@ dependencies = [ [[package]] name = "rustical_carddav" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "axum", @@ -3155,7 +3155,7 @@ dependencies = [ [[package]] name = "rustical_dav" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "axum", @@ -3180,7 +3180,7 @@ dependencies = [ [[package]] name = "rustical_dav_push" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "axum", @@ -3205,7 +3205,7 @@ dependencies = [ [[package]] name = "rustical_frontend" -version = "0.9.0" +version = "0.9.1" dependencies = [ "askama", "askama_web", @@ -3238,7 +3238,7 @@ dependencies = [ [[package]] name = "rustical_ical" -version = "0.9.0" +version = "0.9.1" dependencies = [ "axum", "chrono", @@ -3256,7 +3256,7 @@ dependencies = [ [[package]] name = "rustical_oidc" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "axum", @@ -3271,7 +3271,7 @@ dependencies = [ [[package]] name = "rustical_store" -version = "0.9.0" +version = "0.9.1" dependencies = [ "anyhow", "async-trait", @@ -3305,7 +3305,7 @@ dependencies = [ [[package]] name = "rustical_store_sqlite" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "chrono", @@ -3326,7 +3326,7 @@ dependencies = [ [[package]] name = "rustical_xml" -version = "0.9.0" +version = "0.9.1" dependencies = [ "quick-xml", "thiserror 2.0.16", diff --git a/Cargo.toml b/Cargo.toml index c140f10..148f44d 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -2,7 +2,7 @@ members = ["crates/*"] [workspace.package] -version = "0.9.0" +version = "0.9.1" edition = "2024" description = "A CalDAV server" repository = "https://github.com/lennart-k/rustical" From bf5d874481aa03f38e8d1035bed78070f1d5e33b Mon Sep 17 00:00:00 2001 From: Lennart <18233294+lennart-k@users.noreply.github.com> Date: Thu, 28 Aug 2025 14:53:17 +0200 Subject: [PATCH 03/11] frontend tweaks --- .../js-components/lib/edit-addressbook-form.ts | 2 +- .../frontend/js-components/lib/edit-calendar-form.ts | 2 +- .../public/assets/js/edit-addressbook-form.mjs | 2 +- .../frontend/public/assets/js/edit-calendar-form.mjs | 2 +- crates/frontend/public/assets/style.css | 12 ++++++++++++ 5 files changed, 16 insertions(+), 4 deletions(-) diff --git a/crates/frontend/js-components/lib/edit-addressbook-form.ts b/crates/frontend/js-components/lib/edit-addressbook-form.ts index 353ecd6..9a0dd21 100644 --- a/crates/frontend/js-components/lib/edit-addressbook-form.ts +++ b/crates/frontend/js-components/lib/edit-addressbook-form.ts @@ -30,7 +30,7 @@ export class EditAddressbookForm extends LitElement { return html` -

Create addressbook

+

Edit addressbook