Skip to content

Commit d04e4d5

Browse files
bubasumabubasuma
committed
MC-36809: Secure flag is not set for frontend cookies on https
- Fix secure cookie JS config is missing on frontend
1 parent 53bcc78 commit d04e4d5

File tree

3 files changed

+97
-4
lines changed

3 files changed

+97
-4
lines changed

‎app/code/Magento/Cookie/Test/Mftf/Test/StorefrontVerifySecureCookieTest.xml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="StorefrontVerifySecureCookieTest">
12+
<annotations>
13+
<features value="Cookie"/>
14+
<stories value="Storefront Secure Cookie"/>
15+
<title value="Verify Storefront Cookie Secure Config over https"/>
16+
<description value="Verify that cookie are secure on storefront over https"/>
17+
<severity value="MAJOR"/>
18+
<testCaseId value="MC-36900"/>
19+
<useCaseId value="MC-36809"/>
20+
<group value="cookie"/>
21+
<group value="configuration"/>
22+
<group value="secure_storefront_url"/>
23+
</annotations>
24+
<before>
25+
<amOnPage url="/" stepKey="goToHomePage"/>
26+
<executeJS function="return window.location.host" stepKey="hostname"/>
27+
<magentoCLI command="config:set web/unsecure/base_url https://{$hostname}/" stepKey="setUnsecureBaseURL"/>
28+
<magentoCLI command="config:set web/secure/base_url https://{$hostname}/" stepKey="setSecureBaseURL"/>
29+
<magentoCLI command="config:set web/secure/use_in_frontend 1" stepKey="useSecureURLsOnStorefront"/>
30+
<actionGroup ref="CliCacheFlushActionGroup" stepKey="flushCache">
31+
<argument name="tags" value=""/>
32+
</actionGroup>
33+
</before>
34+
<after>
35+
<amOnPage url="/" stepKey="goToHomePage"/>
36+
<executeJS function="return window.location.host" stepKey="hostname"/>
37+
<magentoCLI command="config:set web/unsecure/base_url http://{$hostname}/" stepKey="setUnsecureBaseURL"/>
38+
<magentoCLI command="config:set web/secure/base_url http://{$hostname}/" stepKey="setSecureBaseURL"/>
39+
<magentoCLI command="config:set web/secure/use_in_frontend 0" stepKey="useSecureURLsOnStorefront"/>
40+
<actionGroup ref="CliCacheFlushActionGroup" stepKey="flushCache">
41+
<argument name="tags" value=""/>
42+
</actionGroup>
43+
</after>
44+
<amOnPage url="/" stepKey="goToHomePage"/>
45+
<executeJS function="return window.cookiesConfig.secure ? 'true' : 'false'" stepKey="isCookieSecure"/>
46+
<assertEquals stepKey="assertCookieIsSecure">
47+
<actualResult type="variable">isCookieSecure</actualResult>
48+
<expectedResult type="string">true</expectedResult>
49+
</assertEquals>
50+
</test>
51+
</tests>

‎app/code/Magento/Cookie/Test/Mftf/Test/StorefrontVerifyUnsecureCookieTest.xml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="StorefrontVerifyUnsecureCookieTest">
12+
<annotations>
13+
<features value="Cookie"/>
14+
<stories value="Storefront Secure Cookie"/>
15+
<title value="Verify Storefront Cookie Secure Config over http"/>
16+
<description value="Verify that cookie are not secure on storefront over http"/>
17+
<severity value="MAJOR"/>
18+
<testCaseId value="MC-36899"/>
19+
<useCaseId value="MC-36809"/>
20+
<group value="cookie"/>
21+
<group value="configuration"/>
22+
</annotations>
23+
<before>
24+
<actionGroup ref="CliCacheFlushActionGroup" stepKey="flushCache">
25+
<argument name="tags" value=""/>
26+
</actionGroup>
27+
</before>
28+
<after>
29+
<actionGroup ref="CliCacheFlushActionGroup" stepKey="flushCache">
30+
<argument name="tags" value=""/>
31+
</actionGroup>
32+
</after>
33+
<amOnPage url="/" stepKey="goToHomePage"/>
34+
<executeJS function="return window.cookiesConfig.secure ? 'true' : 'false'" stepKey="isCookieSecure"/>
35+
<assertEquals stepKey="assertCookieIsUnsecure">
36+
<actualResult type="variable">isCookieSecure</actualResult>
37+
<expectedResult type="string">false</expectedResult>
38+
</assertEquals>
39+
</test>
40+
</tests>

‎app/code/Magento/Cookie/view/base/templates/html/cookie.phtml

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,11 @@
1010
* @var $block \Magento\Framework\View\Element\Js\Cookie
1111
* @var \Magento\Framework\View\Helper\SecureHtmlRenderer $secureRenderer
1212
*/
13-
14-
$scriptString = '
13+
$isCookieSecure = $block->getSessionConfig()->getCookieSecure() ? 'true' : 'false';
14+
$scriptString = "
1515
window.cookiesConfig = window.cookiesConfig || {};
16-
window.cookiesConfig.secure = ' . /* @noEscape */ $block->getSessionConfig()->getCookieSecure() ? 'true' : 'false';
16+
window.cookiesConfig.secure = $isCookieSecure;
17+
";
18+
?>
1719

18-
echo /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false);
20+
<?= /* @noEscape */ $secureRenderer->renderTag('script', [], $scriptString, false) ?>

0 commit comments

Comments
 (0)