Skip to content

CookieRequestCache should set SameSite on the REDIRECT_URI cookie #15204

Closed

Description

@2is10

Describe the bug
When using CookieRequestCache, Firefox complains:

Cookie “REDIRECT_URI” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

image

To Reproduce
Configure your application to use CookieRequestCache, like so:

http.requestCache(config -> config.requestCache(new CookieRequestCache()));

Note that due to #2932 you likely also need to separately pass the CookieRequestCache to SavedRequestAwareAuthenticationSuccessHandler.

Expected behavior
No warning in Firefox. The POST /login request should also not show up as “blocked”.

image

Sample

No sample provided. This is easy to try on any project.

Activity

  1. marcusdacoregio commented on Jun 10, 2024

    @marcusdacoregio
    Contributor

    Hi @2is10, thanks for the report.

    I believe that we could add some kind of customizer to the cookie in the CookieRequestCache implementation, similar to #15203, what do you think?

    I don't think that we should set a default value to that attribute tho, since the docs mention that the attribute is optional and, if not provided, a default value (defined by the browser) will be used.

  2. marcusdacoregio commented on Sep 3, 2024

    @marcusdacoregio
    Contributor

    Closed via #15685

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions