From 06c0fa8d5c4e8ac04d42c27202098eec3d54f1df Mon Sep 17 00:00:00 2001 From: Andy Wilkinson Date: Wed, 9 Sep 2026 08:18:47 +0100 Subject: [PATCH] Retain WebFlux's default SameSite when property not set Fixes gh-51636 --- .../WebSessionIdResolverAutoConfiguration.java | 3 +-- .../autoconfigure/WebFluxAutoConfigurationTests.java | 11 +++++++++++ 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/WebSessionIdResolverAutoConfiguration.java b/module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/WebSessionIdResolverAutoConfiguration.java index b46b8bb0ea2..4803394d3f2 100644 --- a/module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/WebSessionIdResolverAutoConfiguration.java +++ b/module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/WebSessionIdResolverAutoConfiguration.java @@ -26,7 +26,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplicat import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.context.properties.PropertyMapper; import org.springframework.boot.web.server.Cookie; -import org.springframework.boot.web.server.Cookie.SameSite; import org.springframework.boot.web.server.autoconfigure.ServerProperties; import org.springframework.context.annotation.Bean; import org.springframework.http.ResponseCookie.ResponseCookieBuilder; @@ -76,7 +75,7 @@ public final class WebSessionIdResolverAutoConfiguration { map.from(cookie::getSecure).to(builder::secure); map.from(cookie::getMaxAge).to(builder::maxAge); map.from(cookie::getPartitioned).to(builder::partitioned); - map.from(cookie::getSameSite).as(SameSite::attributeValue).always().to(builder::sameSite); + map.from(cookie::getSameSite).to((sameSite) -> builder.sameSite(sameSite.attributeValue())); } } diff --git a/module/spring-boot-webflux/src/test/java/org/springframework/boot/webflux/autoconfigure/WebFluxAutoConfigurationTests.java b/module/spring-boot-webflux/src/test/java/org/springframework/boot/webflux/autoconfigure/WebFluxAutoConfigurationTests.java index 83af949ac5e..bc40fcb630f 100644 --- a/module/spring-boot-webflux/src/test/java/org/springframework/boot/webflux/autoconfigure/WebFluxAutoConfigurationTests.java +++ b/module/spring-boot-webflux/src/test/java/org/springframework/boot/webflux/autoconfigure/WebFluxAutoConfigurationTests.java @@ -86,6 +86,7 @@ import org.springframework.http.server.reactive.HttpHandler; import org.springframework.mock.http.server.reactive.MockServerHttpRequest; import org.springframework.mock.web.server.MockServerWebExchange; import org.springframework.test.util.ReflectionTestUtils; +import org.springframework.util.MultiValueMap; import org.springframework.util.StringUtils; import org.springframework.validation.Validator; import org.springframework.validation.beanvalidation.LocalValidatorFactoryBean; @@ -672,6 +673,16 @@ class WebFluxAutoConfigurationTests { this.contextRunner.run(assertMaxSessionsWithWebSession(defaultMaxSessions)); } + @Test + void cookieSerializerUsesLaxSameSitePolicyByDefault() { + this.contextRunner.run(assertExchangeWithSession((exchange) -> { + MultiValueMap stuff = exchange.getResponse().getCookies(); + List cookies = stuff.get("SESSION"); + assertThat(cookies).isNotEmpty(); + assertThat(cookies).extracting(ResponseCookie::getSameSite).containsOnly("Lax"); + })); + } + @Test void customSessionCookieConfigurationShouldBeApplied() { this.contextRunner.withPropertyValues("server.reactive.session.cookie.name:JSESSIONID",