Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Treat cookies as "SameSite=Lax" by default. #1325

Merged
merged 2 commits into from
Dec 2, 2020
Merged

Treat cookies as "SameSite=Lax" by default. #1325

merged 2 commits into from
Dec 2, 2020

Conversation

miketaylr
Copy link
Collaborator

@miketaylr miketaylr commented Oct 28, 2020 •
edited

Opening for discussion, per the last interim group meeting.

This should correspond to https://tools.ietf.org/html/draft-west-cookie-incrementalism-01#section-3.1

@mikewest mikewest added 6265bis 6265bis samesite RFC6265bis's `SameSite` cookie attribute. labels Oct 28, 2020
@englehardt englehardt mentioned this pull request Nov 9, 2020
Closed
@miketaylr
Copy link
Collaborator Author

Can you please review, @chlily1?

@miketaylr
Copy link
Collaborator Author

Thanks for the review! I fixed the bug you found. cc @mikewest if you also want to have a look (or merge).

@chlily1
Copy link
Contributor

chlily1 commented Nov 11, 2020

Thanks for the review! I fixed the bug you found. cc @mikewest if you also want to have a look (or merge).

Thanks, LGTM

@chlily1
Copy link
Contributor

chlily1 commented Nov 24, 2020

Sorry, one more thing,

Could you please update the non-normative section about SameSite on line 664 to note that if the SameSite attribute value is not specified or is something other than the 3 recognized keywords, it will be subject to a default enforcement mode that is equivalent to Lax?

@mikewest
Copy link
Member

This looks right to me. Can you also update the changelog in the appendix with this new behavior? Happy to merge it once Lily is happy; we should then be able to spin out an -07 draft since the CfA went through (@mnot to confirm from a process perspective).

@miketaylr
Copy link
Collaborator Author

OK, done. For @chlily1 & @mikewest to look at again. 🦃

@miketaylr miketaylr mentioned this pull request Nov 25, 2020
Merged
@miketaylr
Copy link
Collaborator Author

Note: this should land before #1323 (assuming there aren't any further changes).

@chlily1
Copy link
Contributor

chlily1 commented Dec 1, 2020

OK, done. For @chlily1 & @mikewest to look at again. 🦃

LGTM, thanks!

@mikewest
Copy link
Member

mikewest commented Dec 2, 2020

As per @mnot and @tfpauly's note on the mailing list, there's consensus to adopt the incrementalism draft, so I'll start landing these. Thanks for your patience! :)

@mikewest mikewest merged commit 5585dfd into httpwg:master Dec 2, 2020
@miketaylr miketaylr deleted the lax-by-default branch December 2, 2020 14:38
This was referenced Dec 8, 2020
Merged
Closed
mikewest pushed a commit that referenced this pull request Dec 9, 2020
@FiloSottile
Remove leftover paragraph about unknown SameSite values (#1339)
c467bb9 
It looks like this was forgotten in #1325, when unknown values were
switched from None to Default.
@chlily1 chlily1 mentioned this pull request Feb 4, 2021
Closed
@titusfortner titusfortner mentioned this pull request Feb 5, 2021
Open
@chromium-wpt-export-bot chromium-wpt-export-bot mentioned this pull request Jul 23, 2021
Merged
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Jul 23, 2021
@chlily1 @chromium-wpt-export-bot
Remove legacy-samesite Web Platform Tests
7847d95 
SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Jul 26, 2021
@chlily1 @chromium-wpt-export-bot
Remove legacy-samesite Web Platform Tests
317f361 
SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}
chromium-wpt-export-bot pushed a commit to web-platform-tests/wpt that referenced this pull request Jul 26, 2021
@chlily1 @chromium-wpt-export-bot
Remove legacy-samesite Web Platform Tests
939731a 
SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}
pull bot pushed a commit to Alan-love/chromium that referenced this pull request Jul 26, 2021
@chlily1
Remove legacy-samesite Web Platform Tests
a11b13c 
SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Jul 30, 2021
@chlily1 @moz-wptsync-bot
Bug 1721957 [wpt PR 29758] - Remove legacy-samesite Web Platform Test…
bf88963 
…s, a=testonly

Automatic update from web-platform-tests
Remove legacy-samesite Web Platform Tests

SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}

--

wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68
wpt-pr: 29758
moz-v2v-gh pushed a commit to mozilla/gecko-dev that referenced this pull request Jul 31, 2021
@chlily1 @moz-wptsync-bot
Bug 1721957 [wpt PR 29758] - Remove legacy-samesite Web Platform Test…
c80d70b 
…s, a=testonly

Automatic update from web-platform-tests
Remove legacy-samesite Web Platform Tests

SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}

--

wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68
wpt-pr: 29758
jamienicol pushed a commit to jamienicol/gecko that referenced this pull request Aug 4, 2021
@chlily1 @moz-wptsync-bot
Bug 1721957 [wpt PR 29758] - Remove legacy-samesite Web Platform Test…
afb11fa 
…s, a=testonly

Automatic update from web-platform-tests
Remove legacy-samesite Web Platform Tests

SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}

--

wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68
wpt-pr: 29758
jamienicol pushed a commit to jamienicol/gecko that referenced this pull request Aug 4, 2021
@chlily1 @moz-wptsync-bot
Bug 1721957 [wpt PR 29758] - Remove legacy-samesite Web Platform Test…
539ae4e 
…s, a=testonly

Automatic update from web-platform-tests
Remove legacy-samesite Web Platform Tests

SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}

--

wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68
wpt-pr: 29758
mjfroman pushed a commit to mjfroman/moz-libwebrtc-third-party that referenced this pull request Oct 14, 2022
@chlily1
Remove legacy-samesite Web Platform Tests
357a438 
SameSite-Lax-by-default and SameSite=None-requires-Secure have been
standardized ([1], [2]) and launched in Chromium [3] as well as
Firefox [4]. The WPTs testing "legacy" behavior are no longer needed,
and they are also failing on wpt.fyi [5].

This change removes the legacy-samesite virtual test suite, as well as
the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The
test for SameSite=None-requires-Secure also loses its "tentative"
designation.

Chromium will soon no longer support the configuration used in the
virtual test suite, so there would be no way to run these tests anyway.

[1] httpwg/http-extensions#1325
[2] httpwg/http-extensions#1323
[3] https://crrev.com/c/2231445
[4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/
[5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144

Bug: 961439, 1211388
Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679
Reviewed-by: Steven Bingler <bingler@chromium.org>
Commit-Queue: Lily Chen <chlily@chromium.org>
Cr-Commit-Position: refs/heads/master@{#905289}
NOKEYCHECK=True
GitOrigin-RevId: a11b13cf0fb388ee424f03814c955052856331ad
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chlily1 chlily1 chlily1 left review comments

Assignees
No one assigned
Labels
6265bis samesite RFC6265bis's `SameSite` cookie attribute. 6265bis
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
3 participants
@miketaylr @chlily1 @mikewest