Uploading images sometimes will give invalid csrf token (some cookies are misusing the recommended "SameSite" attribute)

[Patrick]

As for the missing SameSite attribute value / as for the yellow background text:

Most likely upstream issue.

⚓ T325663 Audit use of cookies #2

In short: MediaWiki I guess uses different code paths for creating cookies. That’s why some cookies are missing that setting.

I don’t think this warning causing the invalid CSRF token issue.

---

might be caused by this:

MediaWiki Cookie / https / onion settings

A few settings have been hardened for better security… https website version and onion website version: Now using HttpOnly. HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it). Manual:$wgCookieHttpOnly - MediaWiki $wgCookieHttpOnly = true; https website version and onion website version: Now using SameSite …

---

---

Does this sounds like the issue…?

MediaWiki Cookie / https / onion settings

This has the disadvantage when following a link from a different domain name (such as from a search engine to whonix.org or from kicksecure.com to whonix.org) that the user appears to be logged out. Even in case the user is already logged in. When going to the URL bar and pressing enter, the user will appear logged-in. (Of course only if the user was previously logged in.) This is not a bug. This is to be expected when setting cookies to SameSite=Strict as per browser defaults. While not a bu…