Same-Site flag for session cookie in Spring Security

Question

Is it possible to set Same-site Cookie flag in Spring Security?

And if not, is it on a roadmap to add support, please? There is already support in some browsers (i.e. Chrome).

Answer 1

New Tomcat version support SameSite cookies via TomcatContextCustomizer. So you should only customize tomcat CookieProcessor, e.g. for Spring Boot:

@Configuration public class MvcConfiguration implements WebMvcConfigurer {     @Bean     public TomcatContextCustomizer sameSiteCookiesConfig() {         return context -> {             final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();             cookieProcessor.setSameSiteCookies(SameSiteCookies.NONE.getValue());             context.setCookieProcessor(cookieProcessor);         };     } } 

For SameSiteCookies.NONE be aware, that cookies are also Secure (SSL used), otherwise they couldn't be applied.

By default since Chrome 80 cookies considered as SameSite=Lax!

See SameSite Cookie in Spring Boot and SameSite cookie recipes.

---

For nginx proxy it could be solved easily in nginx config:

if ($scheme = http) {     return 301 https://$http_host$request_uri; }  proxy_cookie_path / "/; secure; SameSite=None"; 

UPDATE from @madbreaks: proxy_cookie_flags iso proxy_cookie_path

proxy_cookie_flags ~ secure samesite=none;