Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Set SameSite default to Lax

Browse Source 
Issue: SPR-16418
This commit is contained in:
Vedran Pavic
2018-07-20 23:19:21 +02:00
committed by Brian Clozel
parent 0def1640f2
commit 82194f4ee0
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-web/src/main/java/org/springframework/web/server/session/CookieWebSessionIdResolver.java
View File

@@ -125,7 +125,7 @@ public class CookieWebSessionIdResolver implements WebSessionIdResolver {
.maxAge(maxAge)
.httpOnly(true)
.secure("https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme()))
.sameSite("Strict");
.sameSite("Lax");
if (this.cookieInitializer != null) {
this.cookieInitializer.accept(cookieBuilder);