You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, a number of browsers complain on page load that our session cookie doesn't specify a SameSite value. While I suppose we might want to have the user's session when it's accessed embedded in some other site, I have my doubts that it's a good default.
To wit, the MITRE lists this in their "Common Weakness Enumeration" (CWE) DB as a "Medium" level risk (as CWE-1275). That leads me to believe that there is probably at least some auditor somewhere that would flag this.
Here is an example of someone asking about these messages in the wild. I propose we adopt the fix from that link. That is, add extra: "SameSite=String" to the end of the @session_optionshere.
The text was updated successfully, but these errors were encountered:
Hi @jvantuyl! We set same_site: "Lax" by default for newly generated apps, so I think we are okay here. See #4677 for details. Thanks for the report :)
Currently, a number of browsers complain on page load that our session cookie doesn't specify a
SameSite
value. While I suppose we might want to have the user's session when it's accessed embedded in some other site, I have my doubts that it's a good default.To wit, the MITRE lists this in their "Common Weakness Enumeration" (CWE) DB as a "Medium" level risk (as CWE-1275). That leads me to believe that there is probably at least some auditor somewhere that would flag this.
Here is an example of someone asking about these messages in the wild. I propose we adopt the fix from that link. That is, add
extra: "SameSite=String"
to the end of the@session_options
here.The text was updated successfully, but these errors were encountered: