same-site-cookie not enforced

[nbbn]

Hi, I try to set SameSite cookies, but I have some issue. I found:

proxy:
  same-site-cookie: none

I have it working because I see it in debug log:

2021-08-19 11:23:46.892 DEBUG 29 --- [           main] o.s.c.e.PropertySourcesPropertyResolver  : Found key 'proxy.same-site-cookie' in PropertySource 'configurationProperties' with value of type String
2021-08-19 11:23:46.896 DEBUG 29 --- [           main] ication$$EnhancerBySpringCGLIB$$5eee0b1d : Setting sameSiteCookie policy to none

I tried also None and Strict However, I still the same cookie, without SameSite.

$ curl https://xxx.com/login -v
...
Set-Cookie: JSESSIONID=.......; path=/; secure; HttpOnly

Do I misunderstand something about SameSite cookies?

Thanks, Jakub

[LEDfan]

Hi @nbbn

In the current release (ShinyProxy 2.5.0) this option only works when using Redis to achieve session persistence. When using the built-in session management of ShinyProxy, this option is ignored. This shortcoming is fixed in the next ShinyProxy release (2.6.0), which will be released soon. You could already have a play with it (see https://hub.docker.com/r/openanalytics/shinyproxy-snapshot/tags?page=1&ordering=last_updated for Docker images and [here](https://nexus.openanalytics.eu/service/rest/v1/search/assets/download?sort=version&repository=snapshots&maven.groupId=eu.openanalytics&maven.artifactId=shinyproxy&maven.extension=jar for a JAR). You can find the preview docs here: https://shinyproxy.io/2.6.0-preview/ (but some features are not yet fully documented).

BTW in the 2.6.0 release we also changed handling of the same-site policy of cookies, which I think you may be interested in as well. See: https://shinyproxy.io/2.6.0-preview/documentation/configuration/#security

[nbbn]

Thanks for reply! Indeed, I was looking for a feature, that will be introduced in 2.6.0, not Redis-related. Then, I will wait for it even more impatiently :)

BTW: why it would be good to have shinyproxy.io indexed by Google (I don't know why it is not, but e.g. site:shinyproxy.io has no results).

[LEDfan]

Thanks for letting us know that our site wasn't indexed by Google. There was a misconfiguration in the process that generates the site and this is now fixed.

[nbbn]

Amazing, thanks!