spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity

Ensure that the session same site defaults to "lax"

Browse Source 
Remove the `always()` call from the same site mapping and replace `as`
with a direct call. This update means that mapping only occurs when
`getSameSite` is not `null`, but mapping can still be applied if
`sameSite.getAttributeValue()` returns `null`.

Closes gh-48830
This commit is contained in:
Phillip Webb
2026-01-15 17:36:56 -08:00
parent 5d2373eab8
commit ea564d21e0
1 changed files with 1 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
module/spring-boot-session/src/main/java/org/springframework/boot/session/autoconfigure/SessionAutoConfiguration.java
+1 -2
View File
@@ -37,7 +37,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplicat
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.web.server.Cookie;
import org.springframework.boot.web.server.Cookie.SameSite;
import org.springframework.boot.web.server.autoconfigure.ServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
@@ -116,7 +115,7 @@ public final class SessionAutoConfiguration {
map.from(cookie::getHttpOnly).to(cookieSerializer::setUseHttpOnlyCookie);
map.from(cookie::getSecure).to(cookieSerializer::setUseSecureCookie);
map.from(cookie::getMaxAge).asInt(Duration::getSeconds).to(cookieSerializer::setCookieMaxAge);
map.from(cookie::getSameSite).as(SameSite::attributeValue).always().to(cookieSerializer::setSameSite);
map.from(cookie::getSameSite).to((sameSite) -> cookieSerializer.setSameSite(sameSite.attributeValue()));
map.from(cookie::getPartitioned).to(cookieSerializer::setPartitioned);
cookieSerializerCustomizers.orderedStream()
.forEach((customizer) -> customizer.customize(cookieSerializer));