Commits on Mar 22, 2021

1. Improve cookie SameSite/secure handling …

   Add new "samesite" option in [server] section to configure
   SameSite header for cookies.
   
   As a fallback, use local.host to detect URL scheme and set
   SameSite to "None" (https) or "Lax" (http) accordingly.
   
   Set `Secure` attribute in response header so that cookies
   will only be sent when requesting content from `https://`
   URLs.
   
   Fixes:
   ```
   Cookie “isso-[id]” will be soon rejected because it has the “SameSite” attribute set to “None”
   ```
   
   See: https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
   and https://werkzeug.palletsprojects.com/en/1.0.x/http/#werkzeug.http.dump_cookie

   

   ix5 committed Mar 22, 2021
   Copy the full SHA

   be538a2 View commit details

   Browse the repository at this point in the history

2. tests: Test host-dependent secure/insecure cookies …

   Ensure that:
   > Set `Secure` attribute in response header so that cookies
   > will only be sent when requesting content from `https://`
   > URLs.
   
   And also:
   > Respect samesite conf item in [server] section.
   > As a fallback, use local.host to detect URL scheme and set
   > SameSite to "None" (https) or "Lax" (http) accordingly.

   

   ix5 committed Mar 22, 2021
   Copy the full SHA

   2919461 View commit details

   Browse the repository at this point in the history