Sync with main

[nitya]

No description provided.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

To fix the problem, update the cookie-setting lines (271 and 272) so the cookies are set with secure=True, httponly=True, and samesite='Strict' (or 'Lax', depending on the application's requirements; 'Strict' is safest). This change only affects the arguments to response.set_cookie and does not alter existing functionality, except to make the cookies more resistant to network and script-based attacks. No imports or additional definitions are needed for this, as FastAPI (built atop Starlette) supports these flags directly.

To fix this problem, set the secure, httponly, and samesite attributes explicitly when calling response.set_cookie for both "thread_id" and "agent_id". This should be done on lines 271 and 272. The best practice is to set secure=True (sent only over HTTPS), httponly=True (not accessible to JS), and samesite='Lax' (prevents CSRF by limiting cross-origin cookie sending). This change should not affect functionality but will ensure cookies are sent safely. No additional imports are needed because the attributes are supported directly by the FastAPI/Starlette API.

---

To address the information exposure through exception error, we should ensure that details of exceptions are logged on the server, but clients only receive a generic error message. In .azd-setup/src/api/routes.py, inside the get_result generator function, in the exception handling block (lines 221-223), replace str(e) with a fixed, non-revealing string, such as "An internal error has occurred." The logger will still store the full exception (including stack trace) for server-side review.
No new imports or methods are required, since logging is already present. Only the relevant yield serialize_sse_event(...) line needs changing.

---

To fix the problem, set the secure, httponly, and samesite flags explicitly when calling response.set_cookie.

• secure=True ensures the cookie is only sent over HTTPS.
• httponly=True makes the cookie inaccessible to client-side JavaScript.
• samesite='Lax' (or 'Strict' if strictest CSRF protection is desired) limits the contexts in which the cookie is sent, mitigating CSRF.

Best fixed by:

• In file .azd-setup/src/api/routes.py, lines 349-350, update the set_cookie calls to include: secure=True, httponly=True, samesite='Lax'.

No imports or other code changes are needed, as StreamingResponse.set_cookie supports these parameters directly.

---

To fix this issue, both cookie-setting calls on lines 349 and 350 should use secure attributes to protect them. Update each call to response.set_cookie to specify secure=True, httponly=True, and samesite='Strict'. This is accomplished by editing only these lines within the file .azd-setup/src/api/routes.py. No additional imports or restructuring are required. These changes will ensure that these cookies are only sent over HTTPS, are not accessible clientside from JavaScript, and are protected against cross-origin requests.