Support for setting SameSite attribute explicitly via application.conf

ninjaframework / ninja

Ninja is a full stack web framework for Java. Rock solid, fast and super productive.

http://www.ninjaframework.org

Apache License 2.0

1.91k stars 519 forks source link

Support for setting SameSite attribute explicitly via application.conf #690

Open ghost opened 3 years ago

ghost commented 3 years ago

Cookie prefix, session expiry etc. can all be set via application.conf, but I haven't been able to set the SameSite attribute thus far.

Has anybody else?

Is it documented anywhere?

hugogoncalves commented 3 years ago

Simply said, SameSite attribute is not part of Servlet API 3.1 so we have no support . I lost maybe 2 days looking for a solution. It looks we can try to use a more recent version of Jetty and set comment cookie atribute cookieHttp.setComment(HttpCookie.SAME_SITE_NONE_COMMENT); This is little fishy. https://wiki.shibboleth.net/confluence/display/DEV/Tomcat+and+Jetty+SameSite+Workarounds

I have not tried this solution. I have make some atemps with filters.