djcheckup 0.3.0__tar.gz → 0.4.0__tar.gz

{djcheckup-0.3.0 → djcheckup-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: djcheckup
-Version: 0.3.0
+Version: 0.4.0
 Summary: DJ Checkup is a security scanner for Django sites.
 Author: Stuart Maxwell
 Author-email: Stuart Maxwell <stuart@amanzi.nz>

{djcheckup-0.3.0 → djcheckup-0.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "djcheckup"
-version = "0.3.0"
+version = "0.4.0"
 description = "DJ Checkup is a security scanner for Django sites."
 readme = "README.md"
 authors = [{ name = "Stuart Maxwell", email = "stuart@amanzi.nz" }]

{djcheckup-0.3.0 → djcheckup-0.4.0}/src/djcheckup/check_defs.py

@@ -75,12 +75,13 @@ Reference:
 csrf_samesite_check = CookieSameSiteCheck(
     check_id="csrf_samesite_check",
     depends_on="csrf_check",
-    name="Is the CSRF cookie SameSite=Lax?",
+    name="Does the CSRF cookie have a SameSite flag?",
     cookie_name="csrftoken",
-    samesite_value="Lax",
     success=True,
     severity=SeverityWeight.HIGH,
-    success_message="CSRF cookie is marked as SameSite=Lax, which helps prevent CSRF attacks via cross-site requests.",
+    success_message="""
+CSRF cookie is marked as SameSite=Lax or SameSite=Strict, which helps prevent CSRF attacks via cross-site requests.
+    """,
     failure_message="""
 Your CSRF cookie is not marked as SameSite=Lax. This increases the risk of CSRF attacks.
 Set `CSRF_COOKIE_SAMESITE = 'Lax'` in your Django settings.
@@ -263,12 +264,11 @@ Reference:
 sessionid_samesite_check = CookieSameSiteCheck(
     check_id="sessionid_samesite_check",
     depends_on="sessionid_cookie_check",
-    name="Is the sessionid cookie SameSite=Lax?",
+    name="Does the sessionid cookie have a SameSite flag?",
     cookie_name="sessionid",
-    samesite_value="Lax",
     success=True,
     severity=SeverityWeight.HIGH,
-    success_message="Sessionid cookie is marked as SameSite=Lax. This helps prevent CSRF attacks.",
+    success_message="Sessionid cookie is marked as SameSite=Lax or SameSite=Strict. This helps prevent CSRF attacks.",
     failure_message="""
 Your sessionid cookie is not marked as SameSite=Lax. This increases the risk of CSRF attacks.
 Set `SESSION_COOKIE_SAMESITE = 'Lax'` in your Django settings.

{djcheckup-0.3.0 → djcheckup-0.4.0}/src/djcheckup/checks.py

@@ -174,10 +174,14 @@ class CookieHttpOnlyCheck(_BaseCheck):
 
 @dataclass
 class CookieSameSiteCheck(_BaseCheck):
-    """A cookie SameSite check."""
+    """A cookie SameSite check.
+
+    Checks that the cookie has the expected SameSite value.
+    If the `samesite_value` is omitted, then it checks if the value is set to Lax or Strict.
+    """
 
     cookie_name: str
-    samesite_value: Literal["Strict", "Lax", "None"]
+    samesite_value: Literal["Strict", "Lax", "None"] | None = None
 
     def check(self, context: SiteCheckContext) -> bool:
         """Check if a specific cookie has a SameSite attribute."""
@@ -186,6 +190,9 @@ class CookieSameSiteCheck(_BaseCheck):
 
         for cookie in context.cookies:
             if cookie.name == self.cookie_name:
+                if not self.samesite_value:
+                    return cookie.get_nonstandard_attr("SameSite") in ["Lax", "Strict"]
+
                 return cookie.get_nonstandard_attr("SameSite") == self.samesite_value
 
         return False