Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add samesite handling to CookieStorage #13

Open
jclausen opened this issue Mar 4, 2021 · 3 comments
Open

Add samesite handling to CookieStorage #13

jclausen opened this issue Mar 4, 2021 · 3 comments

Comments

@jclausen
Copy link
Contributor

jclausen commented Mar 4, 2021

Both Chromium and Firefox have announced plans to, in future releases, reject cookies with a samesite attributes set to "None".

Currently, CookieStorage has no handling for the samesite attribute at all.

CookieStorage should be updated to default samesite to Strict and allow for a configuration and per-cookie override.

@lmajano
Copy link
Contributor

lmajano commented Mar 4, 2021

I agree, acf2018 introduced this, but I am not sure if lucee supports it.

@lmajano
Copy link
Contributor

lmajano commented Mar 4, 2021

Ok, seems it does
https://docs.lucee.org/reference/tags/cookie.html

@wpdebruin
Copy link
Contributor

wpdebruin commented Apr 1, 2021

I just added a pr for samesite. Now I am reading:
CookieStorage should be updated to default samesite to Strict and allow for a configuration and per-cookie override.
Not sure if I agree on that one. If the samesite attribute is not present in cfcookie there is no default set.
I think that should be the default behaviour, to stay close to cfcookie.
If you set a samesite default in the cookiestorage config I agree you can set it on all cookies.

In my PR this is not there yet, it only sets samesite if it is an attribute in the set() function, simular to expires (which I fixed some time ago because it had a wrong default).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants