Handle SameSite attribute for session cookie consistently

[grgrzybek]

No description provided.

[grgrzybek]

https://groups.google.com/g/ops4j/c/28LykWUIqpo

Is it somehow possible to append a SameSite=[None|Lax|Strict] attribute to the default Cookie "JSESSIONID" or to disable it at all?

IS:
JSESSIONID=node010lhb2y6ihrdb13l2ip7p4ihdb4.node0; Path=/; HttpOnly

SHOULD:
JSESSIONID=node010lhb2y6ihrdb13l2ip7p4ihdb4.node0; Path=/; HttpOnly; SameSite=Strict

[grgrzybek]

I just found something I wasn't aware of. For Jetty, I see this code:

public static SameSite getSameSiteFromComment(String comment) {
    if (comment != null) {
        if (comment.contains("__SAME_SITE_STRICT__")) {
            return HttpCookie.SameSite.STRICT;
        }
        if (comment.contains("__SAME_SITE_LAX__")) {
            return HttpCookie.SameSite.LAX;
        }
        if (comment.contains("__SAME_SITE_NONE__")) {
            return HttpCookie.SameSite.NONE;
        }
    }
    return null;
}

So it should be enough (for Jetty) for you to add a cookie comment with __SAME_SITE_STRICT__.

pax-web-tomcat uses by default org.apache.tomcat.util.http.Rfc6265CookieProcessor, but its "sameSiteCookies" defaults to "unset" and it's not handled in Pax Web.

in pax-web-undertow there's special io.undertow.server.handlers.SameSiteCookieHandler which could be configured as extra handler in (Karaf) etc/undertow.xml.

[grgrzybek]

I've added new configuration option (defaults to unset) to org.ops4j.pax.web PID. When installing relevant Karaf feature (pax-web-jetty, pax-web-tomcat or pax-web-undertow), the etc/org.ops4j.pax.web.cfg file will contain:

# SameSite attribute configuration for session cookie (possible values: none, lax, strict)
#org.ops4j.pax.web.session.cookie.sameSite = strict

[olfuerniss]

Thanks, I just enabled/added it (Karaf 4.4.2/Jetty) and it seems to work. :-)

[grgrzybek]

Good to hear ;)