fix: Explicitly set SameSite=Lax for SingleInstanceHandler cookie (W…

…EBAPP-6865) (#8932)
wireapp · Jun 3, 2020 · 5b9f2cd · 5b9f2cd
1 parent 4ab68dd
commit 5b9f2cd
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/src/script/main/SingleInstanceHandler.ts b/src/script/main/SingleInstanceHandler.ts
@@ -61,7 +61,13 @@ export class SingleInstanceHandler {
     if (!!Cookies.get(cookieName)) {
       return false;
     }
-    Cookies.set(cookieName, {appInstanceId: this.instanceId});
+    Cookies.set(
+      cookieName,
+      {appInstanceId: this.instanceId},
+      {
+        sameSite: 'Lax',
+      },
+    );
     if (this.onOtherInstanceStarted) {
       this._startSingleInstanceCheck();
     }

diff --git a/test/unit_tests/main/SingleInstanceHandlerSpec.js b/test/unit_tests/main/SingleInstanceHandlerSpec.js
@@ -29,7 +29,13 @@ describe('SingleInstanceHandler', () => {
       spyOn(Cookies, 'set').and.returnValue(undefined);
       const result = singleInstanceHandler.registerInstance(instanceId);
 
-      expect(Cookies.set).toHaveBeenCalledWith('app_opened', {appInstanceId: instanceId});
+      expect(Cookies.set).toHaveBeenCalledWith(
+        'app_opened',
+        {appInstanceId: instanceId},
+        {
+          sameSite: 'Lax',
+        },
+      );
       expect(result).toBe(true);
     });