Add SameSite session cookie config property for WebFlux

This commit adds a new `spring.webflux.session.cookie.same-site`
confuguration property that sets the default value for the "SameSite"
attribute in the WebFlux session cookies.

Closes gh-20970

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java

@@ -75,6 +75,9 @@ import org.springframework.web.server.adapter.WebHttpHandlerBuilder;
 import org.springframework.web.server.i18n.AcceptHeaderLocaleContextResolver;
 import org.springframework.web.server.i18n.FixedLocaleContextResolver;
 import org.springframework.web.server.i18n.LocaleContextResolver;
+import org.springframework.web.server.session.CookieWebSessionIdResolver;
+import org.springframework.web.server.session.DefaultWebSessionManager;
+import org.springframework.web.server.session.WebSessionManager;
 
 /**
  * {@link EnableAutoConfiguration Auto-configuration} for {@link EnableWebFlux WebFlux}.
@@ -302,6 +305,17 @@ public class WebFluxAutoConfiguration {
 			return localeContextResolver;
 		}
 
+		@Bean
+		@ConditionalOnMissingBean(name = WebHttpHandlerBuilder.WEB_SESSION_MANAGER_BEAN_NAME)
+		public WebSessionManager webSessionManager() {
+			DefaultWebSessionManager webSessionManager = new DefaultWebSessionManager();
+			CookieWebSessionIdResolver webSessionIdResolver = new CookieWebSessionIdResolver();
+			webSessionIdResolver.addCookieInitializer((cookie) -> cookie
+					.sameSite(this.webFluxProperties.getSession().getCookie().getSameSite().attribute()));
+			webSessionManager.setSessionIdResolver(webSessionIdResolver);
+			return webSessionManager;
+		}
+
 	}
 
 	@Configuration(proxyBeanMethods = false)

spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxProperties.java

@@ -35,6 +35,8 @@ public class WebFluxProperties {
 
 	private final Format format = new Format();
 
+	private final Session session = new Session();
+
 	/**
 	 * Path pattern used for static resources.
 	 */
@@ -65,6 +67,10 @@ public class WebFluxProperties {
 		return this.format;
 	}
 
+	public Session getSession() {
+		return this.session;
+	}
+
 	public String getStaticPathPattern() {
 		return this.staticPathPattern;
 	}
@@ -116,4 +122,62 @@ public class WebFluxProperties {
 
 	}
 
+	public static class Session {
+
+		private final Cookie cookie = new Cookie();
+
+		public Cookie getCookie() {
+			return this.cookie;
+		}
+
+	}
+
+	public static class Cookie {
+
+		/**
+		 * SameSite attribute value for session Cookies.
+		 */
+		private SameSite sameSite = SameSite.LAX;
+
+		public SameSite getSameSite() {
+			return this.sameSite;
+		}
+
+		public void setSameSite(SameSite sameSite) {
+			this.sameSite = sameSite;
+		}
+
+	}
+
+	public enum SameSite {
+
+		/**
+		 * Cookies are sent in both first-party and cross-origin requests.
+		 */
+		NONE("None"),
+
+		/**
+		 * Cookies are sent in a first-party context, also when following a link to the
+		 * origin site.
+		 */
+		LAX("Lax"),
+
+		/**
+		 * Cookies are only sent in a first-party context (i.e. not when following a link
+		 * to the origin site).
+		 */
+		STRICT("Strict");
+
+		private final String attribute;
+
+		SameSite(String attribute) {
+			this.attribute = attribute;
+		}
+
+		public String attribute() {
+			return this.attribute;
+		}
+
+	}
+
 }

spring-boot-project/spring-boot-autoconfigure/src/main/resources/META-INF/additional-spring-configuration-metadata.json

@@ -1766,6 +1766,10 @@
       "description": "Whether to enable Spring's HiddenHttpMethodFilter.",
       "defaultValue": false
     },
+    {
+      "name": "spring.webflux.session.cookie.same-site",
+      "defaultValue": "lax"
+    },
     {
       "name": "spring.webservices.wsdl-locations",
       "type": "java.util.List<java.lang.String>",