[ https://issues.redhat.com/browse/WFLY-13003?page=com.atlassian.jira.plugi... ] Masafumi Miura edited comment on WFLY-13003 at 1/23/20 5:53 AM: ---------------------------------------------------------------- I've already raised UNDERTOW-1600 which is related to this feature. I've just updated a PR for UNDERTOW-1600 https://github.com/undertow-io/undertow/pull/816 which contains the following changes: - Add support for the SameSite=None attribute - Add SameSiteCookieHandler that can set the SameSite attribute on all cookies - Add a utility class SameSiteNoneIncompatibleClientChecker to detect user agents which are incompatible with the SameSite=None attribute. The regex is based on https://www.chromium.org/updates/same-site/incompatible-clients The SameSiteCookieHandler can be enabled with the predicate name "samesite-cookie" through expression-filter in the undertow subsystem. For example: {code:xml} <subsystem xmlns="urn:jboss:domain:undertow:7.0" ...> ... <server name="default-server"> ... <host name="default-host" alias="localhost"> <location name="/" handler="welcome-content"/> <http-invoker security-realm="ApplicationRealm"/> <!-- <filter-ref name="dump-request"/> --> <filter-ref name="samesite-cookie"/> <!-- add this --> </host> </server> ...(snip)... <filters> <!-- <expression-filter name="dump-request" expression="dump-request"/> --> <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=strict)"/> <!-- add this --> <!-- or add the following for Lax or None attribute --> <!-- <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=lax)"/> --> <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=none)"/> </filters> </subsystem> {code} was (Author: mmiura): I've already raised UNDERTOW-1600 which is related to this feature. I've just updated a PR for UNDERTOW-1600 https://github.com/undertow-io/undertow/pull/816 which contains the following changes: - Add support for the SameSite=None attribute - Add SameSiteCookieHandler that can set the SameSite attribute on all cookies - Add a utility class SameSiteNoneIncompatibleClientChecker to detect user agents which are incompatible with the SameSite=None attribute The SameSiteCookieHandler can be enabled with the predicate name "samesite-cookie" through expression-filter in the undertow subsystem. For example: {code:xml} <subsystem xmlns="urn:jboss:domain:undertow:7.0" ...> ... <server name="default-server"> ... <host name="default-host" alias="localhost"> <location name="/" handler="welcome-content"/> <http-invoker security-realm="ApplicationRealm"/> <!-- <filter-ref name="dump-request"/> --> <filter-ref name="samesite-cookie"/> <!-- add this --> </host> </server> ...(snip)... <filters> <!-- <expression-filter name="dump-request" expression="dump-request"/> --> <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=strict)"/> <!-- add this --> <!-- or add the following for Lax or None attribute --> <!-- <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=lax)"/> --> <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=none)"/> </filters> </subsystem> {code} -- This message was sent by Atlassian Jira (v7.13.8#713008)