search

emmett-framework / emmett

The web framework for inventors
Other
1.04k stars 70 forks source link

Adding 'samesite' parameter to sessions #288

Closed ianshk closed 4 years ago

ianshk commented 4 years ago

It would be nice to be able to set the samesite flag as a parameter in SessionManager.

I noticed while using newer versions of chrome, shopify apps block the cookie unless the samesite attribute in the cookie is set to none.

Some information about it https://www.chromestatus.com/feature/5088147346030592

Here is the error I got in the chrome browser. I checked the emmett session cookie in chrome and samesite flag is empty.

A cookie associated with a cross-site resource at https://shopify.com/ was set without the SameSite attribute. It has been blocked, as Chrome now only delivers cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

gi0baro commented 4 years ago

This is included in current master and will be released in 2.1.0

ianshk commented 3 years ago

I confirm this now works great! When do you think 2.1.0 will be released?

gi0baro commented 3 years ago

@ianshk I'm re-thinking milestones content, probably 2.1.0 will be smaller in terms of changes. Hope to release it within next 2 weeks.