Cookie security attributes are going to mandated by Google Chrome

[joakime]

See https://blog.chromium.org/2019/10/developers-get-ready-for-new.html

Also the feedback at #3040 (comment)

We need to have a solution for the following:

• Web Apps using the Servlet Cookie API.
• Session Cookies created by Jetty.
• Http Client Cookie usage / behaviors?

[joakime]

For Session Cookies, we need to support a configuration for the SameSite attribute.

• Not Present
• SameSite=None
• SameSite=Lax
• SameSite=Strict

[blop]

Work is being done also on the servlet-api jakartaee/servlet#175

[joakime]

Opened PR #4271

[gregw]

Note that to use sameSite cookies for the session cookie, you can activate using web.xml (and STRICT/LAX/NONE in the comment):

  <session-config>
    <cookie-config>
      <comment>__SAME_SITE_STRICT__</comment>
    </cookie-config>
  </session-config>

[gregw]

I think we need to do more on this issue. Considering that Chrome will soon ignore cookies without Same-Site, then it is not sufficient just to allow applications to specify Same-Site if they wish. We need the ability to add the attribute to cookies created by existing code - ie the container needs to be able to set a default other than null

[gregw]

See also jakartaee/servlet#271

[janbartel]

The samesite attribute can now be set via a context default value. Thus, the samesite attribute will be present if it is either set explicitly, or there is a default value set for the context. According to the documentation links provided on this issue, chrome will use a default value of LAX if no samesite value is present in a cookie.