Skip to content

sameSite strict for production change #172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 17, 2025
Merged

sameSite strict for production change #172

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
62ba05a
sameSite strict for production change
Mar 12, 2025
d2f4629
environment property added for isproduction
Mar 17, 2025
d09ab95
Merge branch 'develop' into develop
indraniBan Mar 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/main/environment/common_ci.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,9 @@ grievanceDataSyncDuration = @env.GRIEVANCE_DATA_SYNC_DURATION@
springdoc.api-docs.enabled=false
springdoc.swagger-ui.enabled=false


isProduction=false
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey this can't be false.
We should ideally be taking the variable from CI environment.
Use @@

@ravishanigarapu please check.

grievanceAllocationRetryConfiguration=3



2 changes: 2 additions & 0 deletions src/main/environment/common_dev.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,4 +186,6 @@ grievanceDataSyncDuration = <Enter Grievience Data Sync Duration>
springdoc.api-docs.enabled=true
springdoc.swagger-ui.enabled=true

isProduction=false
grievanceAllocationRetryConfiguration=3

2 changes: 1 addition & 1 deletion src/main/environment/common_example.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,7 @@ grievanceDataSyncDuration = <Enter Grievience Data Sync Duration>
springdoc.api-docs.enabled=true
springdoc.swagger-ui.enabled=true

isProduction=false
grievanceAllocationRetryConfiguration=3



2 changes: 1 addition & 1 deletion src/main/environment/common_test.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,5 +187,5 @@ grievanceDataSyncDuration = <Enter Grievience Data Sync Duration>

springdoc.api-docs.enabled=true
springdoc.swagger-ui.enabled=true

isProduction=false
grievanceAllocationRetryConfiguration=3
2 changes: 1 addition & 1 deletion src/main/environment/common_uat.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,5 +158,5 @@ grievanceDataSyncDuration = <Enter Grievience Data Sync Duration>

springdoc.api-docs.enabled=true
springdoc.swagger-ui.enabled=true

isProduction=false
grievanceAllocationRetryConfiguration=3
7 changes: 7 additions & 0 deletions src/main/java/com/iemr/common/utils/CookieUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import java.util.Arrays;
import java.util.Optional;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;

import jakarta.servlet.http.Cookie;
Expand All @@ -11,6 +12,9 @@

@Service
public class CookieUtil {

@Value("${isProduction}")
private Boolean isProduction;
Comment on lines +16 to +17
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Ensure configuration property is defined in all environments.

The @Value("${isProduction}") annotation injects the isProduction property from your configuration files. Make sure this property is properly defined in all environment configurations to avoid potential NullPointerExceptions.

Consider adding a default value in case the property is not defined:

- @Value("${isProduction}")
+ @Value("${isProduction:false}")

🏁 Script executed:

#!/bin/bash
# Verify if the isProduction property is defined in configuration files
echo "Checking for isProduction property in configuration files..."
fd -e yml -e properties -e yaml | xargs grep -l "isProduction" || echo "Warning: isProduction property not found in any configuration files"

Length of output: 338

Action Required: Ensure Default Value for "isProduction" Property

The verification indicates that the isProduction property is not defined in any of the configuration files. To prevent potential NullPointerException issues across environments, please update the injection to provide a default value. For example:

- @Value("${isProduction}")
+ @Value("${isProduction:false}")

Additionally, confirm that any deployment or configuration management setups align with this change.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
@Value("${isProduction}")
private Boolean isProduction;
@Value("${isProduction:false}")
private Boolean isProduction;


public Optional<String> getCookieValue(HttpServletRequest request, String cookieName) {
Cookie[] cookies = request.getCookies();
Expand Down Expand Up @@ -39,6 +43,9 @@ public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, H

// Set the SameSite attribute for cross-site request handling (if needed)
String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None')
if(isProduction) {
sameSite= "Strict";
}
cookie.setSecure(true);

// Build the Set-Cookie header manually (to add SameSite attribute support)
Expand Down
Loading