Cookie “XSRF-TOKEN” will be soon rejected

krakenjs / lusca

Application security for express apps.

Other

1.79k stars 139 forks source link

Cookie “XSRF-TOKEN” will be soon rejected #139

Open miclill opened 4 years ago

miclill commented 4 years ago

My browser says:

Cookie “XSRF-TOKEN” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Cookies

What can I do about it?

linkRace commented 3 years ago

For the meantime, you can set the options of cookie to include secure:true and sameSite:'Strict'. I can put it an update to include those by default soon.