Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for omitting SameSite attribute from session cookie

Browse Source 
See gh-44714

Signed-off-by: Filip Hrisafov <filip.hrisafov@gmail.com>
This commit is contained in:
Filip Hrisafov
2025-03-14 09:33:45 +01:00
committed by Andy Wilkinson
parent 9920b5f252
commit ccbc4f91ec
8 changed files with 52 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/JettyServletWebServerFactory.java
View File

@@ -284,7 +284,7 @@ public class JettyServletWebServerFactory extends AbstractServletWebServerFactor
private void configureSession(WebAppContext context) {
SessionHandler handler = context.getSessionHandler();
SameSite sessionSameSite = getSession().getCookie().getSameSite();
if (sessionSameSite != null) {
if (sessionSameSite != null && sessionSameSite != SameSite.OMITTED) {
handler.setSameSite(HttpCookie.SameSite.valueOf(sessionSameSite.name()));
}
Duration sessionTimeout = getSession().getTimeout();

5
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java
View File

@@ -998,11 +998,12 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto
@Override
public String generateHeader(Cookie cookie, HttpServletRequest request) {
SameSite sameSite = getSameSite(cookie);
if (sameSite == null) {
String sameSiteValue = (sameSite != null) ? sameSite.attributeValue() : null;
if (sameSiteValue == null) {
return super.generateHeader(cookie, request);
}
Rfc6265CookieProcessor delegate = new Rfc6265CookieProcessor();
delegate.setSameSiteCookies(sameSite.attributeValue());
delegate.setSameSiteCookies(sameSiteValue);
return delegate.generateHeader(cookie, request);
}

5
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/UndertowServletWebServerFactory.java
View File

@@ -635,7 +635,10 @@ public class UndertowServletWebServerFactory extends AbstractServletWebServerFac
private void beforeCommit(HttpServerExchange exchange) {
for (Cookie cookie : exchange.responseCookies()) {
SameSite sameSite = getSameSite(asServletCookie(cookie));
if (sameSite != null) {
if (sameSite == SameSite.OMITTED) {
cookie.setSameSite(false);
}
else if (sameSite != null) {
cookie.setSameSiteMode(sameSite.attributeValue());
}
}

5
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/Cookie.java
View File

@@ -145,6 +145,11 @@ public class Cookie {
*/
public enum SameSite {
/**
* The SameSite cookie attribute will be omitted when creating the cookie.
*/
OMITTED(null),
/**
* Cookies are sent in both first-party and cross-origin requests.
*/

21
spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/server/AbstractServletWebServerFactoryTests.java
View File

@@ -881,7 +881,7 @@ public abstract class AbstractServletWebServerFactoryTests {
}
@ParameterizedTest
@EnumSource
@EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED")
void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookies(SameSite sameSite) throws Exception {
AbstractServletWebServerFactory factory = getFactory();
factory.getSession().getCookie().setSameSite(sameSite);
@@ -896,7 +896,7 @@ public abstract class AbstractServletWebServerFactoryTests {
}
@ParameterizedTest
@EnumSource
@EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED")
void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookiesWhenUsingCustomName(SameSite sameSite)
throws Exception {
AbstractServletWebServerFactory factory = getFactory();
@@ -949,6 +949,23 @@ public abstract class AbstractServletWebServerFactoryTests {
(header) -> assertThat(header).contains("test=test").contains("SameSite=Strict"));
}
@Test
void cookieSameSiteSuppliersShouldNotAffectOmittedSameSite() throws IOException, URISyntaxException {
AbstractServletWebServerFactory factory = getFactory();
factory.getSession().getCookie().setSameSite(SameSite.OMITTED);
factory.getSession().getCookie().setName("SESSIONCOOKIE");
factory.addCookieSameSiteSuppliers(CookieSameSiteSupplier.ofStrict());
factory.addInitializers(new ServletRegistrationBean<>(new CookieServlet(false), "/"));
this.webServer = factory.getWebServer();
this.webServer.start();
ClientHttpResponse clientResponse = getClientResponse(getLocalUrl("/"));
assertThat(clientResponse.getStatusCode()).isEqualTo(HttpStatus.OK);
List<String> setCookieHeaders = clientResponse.getHeaders().get("Set-Cookie");
assertThat(setCookieHeaders).satisfiesExactlyInAnyOrder(
(header) -> assertThat(header).contains("SESSIONCOOKIE").doesNotContain("SameSite"),
(header) -> assertThat(header).contains("test=test").contains("SameSite=Strict"));
}
@Test
protected void sslSessionTracking() {
AbstractServletWebServerFactory factory = getFactory();