AscendingCreations / AxumSession

Axum Session Management Libraries that use Sqlx
MIT License
142 stars 29 forks source link

Allow SameSite attribute to be set independently of Domain attribute #32

Closed h-michael closed 1 year ago

h-michael commented 1 year ago

Domain attribute and SameSite attributes are independent of each other. Domain attribute defines the host to which the cookie will be sent. SameSite attribute allows servers to assert that a cookie ought not to be sent along with cross-site requests. SameSite attribute should be configurable independently of Domain attribute.

https://www.rfc-editor.org/rfc/rfc6265#section-4.1.2.3

According to the specification, if server sends set-cookie header without SameSite attribute, SameSite's default value is "Lax" (previously this was "None". It seems changed.).

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Note

This is breaking changes.