root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Add support for omitting SameSite attribute from session cookie 

See gh-44714

Signed-off-by: Filip Hrisafov <filip.hrisafov@gmail.com>
This commit is contained in:
Filip Hrisafov 2025-03-14 09:33:45 +01:00 committed by Andy Wilkinson
parent 9920b5f252
commit ccbc4f91ec
8 changed files with 52 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebSessionIdResolverAutoConfiguration.java
View File

@ -77,12 +77,7 @@ public class WebSessionIdResolverAutoConfiguration {
map.from(cookie::getSecure).to(builder::secure);
map.from(cookie::getMaxAge).to(builder::maxAge);
map.from(cookie::getPartitioned).to(builder::partitioned);
map.from(getSameSite(cookie)).to(builder::sameSite);
}
private String getSameSite(Cookie properties) {
SameSite sameSite = properties.getSameSite();
return (sameSite != null) ? sameSite.attributeValue() : null;
map.from(cookie::getSameSite).as(SameSite::attributeValue).to(builder::sameSite);
}
}

10
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/session/SessionAutoConfigurationTests.java
View File

@ -170,6 +170,16 @@ class SessionAutoConfigurationTests extends AbstractSessionAutoConfigurationTest
});
}
@Test
void sessionCookieSameSiteOmittedIsAppliedToAutoConfiguredCookieSerializer() {
this.contextRunner.withUserConfiguration(SessionRepositoryConfiguration.class)
.withPropertyValues("server.servlet.session.cookie.sameSite=omitted")
.run((context) -> {
DefaultCookieSerializer cookieSerializer = context.getBean(DefaultCookieSerializer.class);
assertThat(cookieSerializer).hasFieldOrPropertyWithValue("sameSite", null);
});
}
@Test
void autoConfiguredCookieSerializerIsUsedBySessionRepositoryFilter() {
this.contextRunner.withUserConfiguration(SessionRepositoryConfiguration.class)

9
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java
View File

@ -676,6 +676,15 @@ class WebFluxAutoConfigurationTests {
}));
}
@Test
void sessionCookieOmittedConfigurationShouldBeApplied() {
this.contextRunner.withPropertyValues("server.reactive.session.cookie.same-site:omitted")
.run(assertExchangeWithSession((exchange) -> {
List<ResponseCookie> cookies = exchange.getResponse().getCookies().get("SESSION");
assertThat(cookies).extracting(ResponseCookie::getSameSite).containsOnlyNulls();
}));
}
@ParameterizedTest
@ValueSource(classes = { ServerProperties.class, WebFluxProperties.class })
void propertiesAreNotEnabledInNonWebApplication(Class<?> propertiesClass) {

2
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/jetty/JettyServletWebServerFactory.java
View File

@ -284,7 +284,7 @@ public class JettyServletWebServerFactory extends AbstractServletWebServerFactor
private void configureSession(WebAppContext context) {
SessionHandler handler = context.getSessionHandler();
SameSite sessionSameSite = getSession().getCookie().getSameSite();
if (sessionSameSite != null) {
if (sessionSameSite != null && sessionSameSite != SameSite.OMITTED) {
handler.setSameSite(HttpCookie.SameSite.valueOf(sessionSameSite.name()));
}
Duration sessionTimeout = getSession().getTimeout();

5
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/TomcatServletWebServerFactory.java
View File

@ -998,11 +998,12 @@ public class TomcatServletWebServerFactory extends AbstractServletWebServerFacto
@Override
public String generateHeader(Cookie cookie, HttpServletRequest request) {
SameSite sameSite = getSameSite(cookie);
if (sameSite == null) {
String sameSiteValue = (sameSite != null) ? sameSite.attributeValue() : null;
if (sameSiteValue == null) {
return super.generateHeader(cookie, request);
}
Rfc6265CookieProcessor delegate = new Rfc6265CookieProcessor();
delegate.setSameSiteCookies(sameSite.attributeValue());
delegate.setSameSiteCookies(sameSiteValue);
return delegate.generateHeader(cookie, request);
}

5
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/undertow/UndertowServletWebServerFactory.java
View File

@ -635,7 +635,10 @@ public class UndertowServletWebServerFactory extends AbstractServletWebServerFac
private void beforeCommit(HttpServerExchange exchange) {
for (Cookie cookie : exchange.responseCookies()) {
SameSite sameSite = getSameSite(asServletCookie(cookie));
if (sameSite != null) {
if (sameSite == SameSite.OMITTED) {
cookie.setSameSite(false);
}
else if (sameSite != null) {
cookie.setSameSiteMode(sameSite.attributeValue());
}
}

5
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/Cookie.java
View File

@ -145,6 +145,11 @@ public class Cookie {
*/
public enum SameSite {
/**
* The SameSite cookie attribute will be omitted when creating the cookie.
*/
OMITTED(null),
/**
* Cookies are sent in both first-party and cross-origin requests.
*/

21
spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/servlet/server/AbstractServletWebServerFactoryTests.java
View File

@ -881,7 +881,7 @@ public abstract class AbstractServletWebServerFactoryTests {
}
@ParameterizedTest
@EnumSource
@EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED")
void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookies(SameSite sameSite) throws Exception {
AbstractServletWebServerFactory factory = getFactory();
factory.getSession().getCookie().setSameSite(sameSite);
@ -896,7 +896,7 @@ public abstract class AbstractServletWebServerFactoryTests {
}
@ParameterizedTest
@EnumSource
@EnumSource(mode = EnumSource.Mode.EXCLUDE, names = "OMITTED")
void sessionCookieSameSiteAttributeCanBeConfiguredAndOnlyAffectsSessionCookiesWhenUsingCustomName(SameSite sameSite)
throws Exception {
AbstractServletWebServerFactory factory = getFactory();
@ -949,6 +949,23 @@ public abstract class AbstractServletWebServerFactoryTests {
(header) -> assertThat(header).contains("test=test").contains("SameSite=Strict"));
}
@Test
void cookieSameSiteSuppliersShouldNotAffectOmittedSameSite() throws IOException, URISyntaxException {
AbstractServletWebServerFactory factory = getFactory();
factory.getSession().getCookie().setSameSite(SameSite.OMITTED);
factory.getSession().getCookie().setName("SESSIONCOOKIE");
factory.addCookieSameSiteSuppliers(CookieSameSiteSupplier.ofStrict());
factory.addInitializers(new ServletRegistrationBean<>(new CookieServlet(false), "/"));
this.webServer = factory.getWebServer();
this.webServer.start();
ClientHttpResponse clientResponse = getClientResponse(getLocalUrl("/"));
assertThat(clientResponse.getStatusCode()).isEqualTo(HttpStatus.OK);
List<String> setCookieHeaders = clientResponse.getHeaders().get("Set-Cookie");
assertThat(setCookieHeaders).satisfiesExactlyInAnyOrder(
(header) -> assertThat(header).contains("SESSIONCOOKIE").doesNotContain("SameSite"),
(header) -> assertThat(header).contains("test=test").contains("SameSite=Strict"));
}
@Test
protected void sslSessionTracking() {
AbstractServletWebServerFactory factory = getFactory();