search

linagora / twake-drive

The open-source alternative to Google Drive.
GNU Affero General Public License v3.0
46 stars 14 forks source link

Add `SameSite` to cookie `X-AuthToken` #516

Closed ericlinagora closed 1 month ago

ericlinagora commented 2 months ago

Describe the bug A warning in Firefox about future version requiring this in the header:

Cookie “X-AuthToken” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Desktop (please complete the following information):

image