Add more descriptive error message in case of enabled "secure_cookies"

[anatoly techtonik <techtonik@…>]

If you have enabled "secure_cookies" then every HTTP request will regenerate them, but won't receive back. This results in "Missing or invalid form token. Do you have cookies enabled?" error on every form submit.

Trac could detect this situation and provide more descriptive message as this issue is hard to debug, especially in combination with other bugs.

How to repeat

Create an empty virtual environment:

# windows virtualenv setup
Scripts\trac-admin cookie_form_token initenv
Scripts\trac-admin cookie_form_token permission add anonymous TRAC_ADMIN

Edit cookie_form_token/conf/trac.ini and set secure_cookies = true

# start server
Scripts\tracd -p 8000 -r -s cookie_form_token

Open page ​http://localhost:8000/admin/ticket/milestones and try to add new milestone.

[anatoly techtonik <techtonik@…>]

See also 5637#comment:26

[Remy Blank]

That makes sense, yes. Also, the documentation for secure_cookies could be improved to mention that case.

[anatoly techtonik <techtonik@…>]

Trivial patch. An ideal version should not generate secure_cookies through http requests at all.

trac/web/main.py

@@ -199 +199 @@
                     if ctype in ('application/x-www-form-urlencoded',
                                  'multipart/form-data') and \
                             req.args.get('__FORM_TOKEN') != req.form_token:
-                        raise HTTPBadRequest('Missing or invalid form token. '
-                                             'Do you have cookies enabled?')
+                        if self.env.secure_cookies and req.scheme == 'http':
+                            raise HTTPBadRequest(
+                               "''secure_cookies'' option is active. "
+                               'You need to use https URL to access the form.')
+                        else:
+                            raise HTTPBadRequest(
+                               'Missing or invalid form token. '
+                               'Do you have cookies enabled?')
 
                 # Process the request and render the template
                 resp = chosen_handler.process_request(req)

[anatoly techtonik <techtonik@…>]

Seems like its impossible to prevent Cookies from being set if 'secure_cookies' Trac is accessed by http protocol. Cookies are sent in Request::_send_cookie_headers() at source:branches/0.11-stable/trac/web/api.py@8375:538#L533​ and this method doesn't have access to env.config to check the value of secure_cookies

[Remy Blank]

Committed a variant of comment:3 in [9228] (and added translation markers for that error message).