spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity

Retain WebFlux's default SameSite when property not set

Browse Source 
Fixes gh-51636
This commit is contained in:
Andy Wilkinson
2026-09-09 08:18:47 +01:00
parent 304b57c839
commit 06c0fa8d5c
2 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/WebSessionIdResolverAutoConfiguration.java
+1 -2
View File
@@ -26,7 +26,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplicat
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.web.server.Cookie;
import org.springframework.boot.web.server.Cookie.SameSite;
import org.springframework.boot.web.server.autoconfigure.ServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.http.ResponseCookie.ResponseCookieBuilder;
@@ -76,7 +75,7 @@ public final class WebSessionIdResolverAutoConfiguration {
map.from(cookie::getSecure).to(builder::secure);
map.from(cookie::getMaxAge).to(builder::maxAge);
map.from(cookie::getPartitioned).to(builder::partitioned);
map.from(cookie::getSameSite).as(SameSite::attributeValue).always().to(builder::sameSite);
map.from(cookie::getSameSite).to((sameSite) -> builder.sameSite(sameSite.attributeValue()));
}
}
module/spring-boot-webflux/src/test/java/org/springframework/boot/webflux/autoconfigure/WebFluxAutoConfigurationTests.java
+11
View File
@@ -86,6 +86,7 @@ import org.springframework.http.server.reactive.HttpHandler;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
import org.springframework.mock.web.server.MockServerWebExchange;
import org.springframework.test.util.ReflectionTestUtils;
import org.springframework.util.MultiValueMap;
import org.springframework.util.StringUtils;
import org.springframework.validation.Validator;
import org.springframework.validation.beanvalidation.LocalValidatorFactoryBean;
@@ -672,6 +673,16 @@ class WebFluxAutoConfigurationTests {
this.contextRunner.run(assertMaxSessionsWithWebSession(defaultMaxSessions));
}
@Test
void cookieSerializerUsesLaxSameSitePolicyByDefault() {
this.contextRunner.run(assertExchangeWithSession((exchange) -> {
MultiValueMap<String, ResponseCookie> stuff = exchange.getResponse().getCookies();
List<ResponseCookie> cookies = stuff.get("SESSION");
assertThat(cookies).isNotEmpty();
assertThat(cookies).extracting(ResponseCookie::getSameSite).containsOnly("Lax");
}));
}
@Test
void customSessionCookieConfigurationShouldBeApplied() {
this.contextRunner.withPropertyValues("server.reactive.session.cookie.name:JSESSIONID",