Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for omitting SameSite attribute from session cookie

Browse Source 
See gh-44714

Signed-off-by: Filip Hrisafov <filip.hrisafov@gmail.com>
This commit is contained in:
Filip Hrisafov
2025-03-14 09:33:45 +01:00
committed by Andy Wilkinson
parent 9920b5f252
commit ccbc4f91ec
8 changed files with 52 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebSessionIdResolverAutoConfiguration.java
View File

@@ -77,12 +77,7 @@ public class WebSessionIdResolverAutoConfiguration {
map.from(cookie::getSecure).to(builder::secure);
map.from(cookie::getMaxAge).to(builder::maxAge);
map.from(cookie::getPartitioned).to(builder::partitioned);
map.from(getSameSite(cookie)).to(builder::sameSite);
}
private String getSameSite(Cookie properties) {
SameSite sameSite = properties.getSameSite();
return (sameSite != null) ? sameSite.attributeValue() : null;
map.from(cookie::getSameSite).as(SameSite::attributeValue).to(builder::sameSite);
}
}

10
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/session/SessionAutoConfigurationTests.java
View File

@@ -170,6 +170,16 @@ class SessionAutoConfigurationTests extends AbstractSessionAutoConfigurationTest
});
}
@Test
void sessionCookieSameSiteOmittedIsAppliedToAutoConfiguredCookieSerializer() {
this.contextRunner.withUserConfiguration(SessionRepositoryConfiguration.class)
.withPropertyValues("server.servlet.session.cookie.sameSite=omitted")
.run((context) -> {
DefaultCookieSerializer cookieSerializer = context.getBean(DefaultCookieSerializer.class);
assertThat(cookieSerializer).hasFieldOrPropertyWithValue("sameSite", null);
});
}
@Test
void autoConfiguredCookieSerializerIsUsedBySessionRepositoryFilter() {
this.contextRunner.withUserConfiguration(SessionRepositoryConfiguration.class)

9
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java
View File

@@ -676,6 +676,15 @@ class WebFluxAutoConfigurationTests {
}));
}
@Test
void sessionCookieOmittedConfigurationShouldBeApplied() {
this.contextRunner.withPropertyValues("server.reactive.session.cookie.same-site:omitted")
.run(assertExchangeWithSession((exchange) -> {
List<ResponseCookie> cookies = exchange.getResponse().getCookies().get("SESSION");
assertThat(cookies).extracting(ResponseCookie::getSameSite).containsOnlyNulls();
}));
}
@ParameterizedTest
@ValueSource(classes = { ServerProperties.class, WebFluxProperties.class })
void propertiesAreNotEnabledInNonWebApplication(Class<?> propertiesClass) {