spring-boot - 如何在 Spring Boot 中设置同站 cookie 标志？

Question

是否可以设置Same-Site Cookie Spring Boot 中的标志？

我在 Chrome 中的问题:

A cookie associated with a cross-site resource at http://google.com/ was set without the SameSite attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with SameSite=None and Secure. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

如何解决这个问题呢？

Answer 1

这是 Spring Security 的一个悬而未决的问题 ( https://github.com/spring-projects/spring-security/issues/7537 )

正如我在 Spring-Boot ( 2.1.7.RELEASE ) 中检查的那样，默认情况下它使用 DefaultCookieSerializer携带属性(property)sameSite默认为 Lax .

您可以通过以下代码在应用程序启动时修改它。

注意:这是一个黑客，直到真正的修复(配置)在下一个 Spring 发布时公开。

@Component
@AllArgsConstructor
public class SameSiteInjector {

  private final ApplicationContext applicationContext;

  @EventListener
  public void onApplicationEvent(ContextRefreshedEvent event) {
    DefaultCookieSerializer cookieSerializer = applicationContext.getBean(DefaultCookieSerializer.class);
    log.info("Received DefaultCookieSerializer, Overriding SameSite Strict");
    cookieSerializer.setSameSite("strict");
  }
}