From ea564d21e0dde3d3df8c933b5b08fed3a555467e Mon Sep 17 00:00:00 2001 From: Phillip Webb Date: Thu, 15 Jan 2026 17:36:56 -0800 Subject: [PATCH] Ensure that the session same site defaults to "lax" Remove the `always()` call from the same site mapping and replace `as` with a direct call. This update means that mapping only occurs when `getSameSite` is not `null`, but mapping can still be applied if `sameSite.getAttributeValue()` returns `null`. Closes gh-48830 --- .../boot/session/autoconfigure/SessionAutoConfiguration.java | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/module/spring-boot-session/src/main/java/org/springframework/boot/session/autoconfigure/SessionAutoConfiguration.java b/module/spring-boot-session/src/main/java/org/springframework/boot/session/autoconfigure/SessionAutoConfiguration.java index 7d0a9967779..dfc5e8697d3 100644 --- a/module/spring-boot-session/src/main/java/org/springframework/boot/session/autoconfigure/SessionAutoConfiguration.java +++ b/module/spring-boot-session/src/main/java/org/springframework/boot/session/autoconfigure/SessionAutoConfiguration.java @@ -37,7 +37,6 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplicat import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.boot.context.properties.PropertyMapper; import org.springframework.boot.web.server.Cookie; -import org.springframework.boot.web.server.Cookie.SameSite; import org.springframework.boot.web.server.autoconfigure.ServerProperties; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Conditional; @@ -116,7 +115,7 @@ public final class SessionAutoConfiguration { map.from(cookie::getHttpOnly).to(cookieSerializer::setUseHttpOnlyCookie); map.from(cookie::getSecure).to(cookieSerializer::setUseSecureCookie); map.from(cookie::getMaxAge).asInt(Duration::getSeconds).to(cookieSerializer::setCookieMaxAge); - map.from(cookie::getSameSite).as(SameSite::attributeValue).always().to(cookieSerializer::setSameSite); + map.from(cookie::getSameSite).to((sameSite) -> cookieSerializer.setSameSite(sameSite.attributeValue())); map.from(cookie::getPartitioned).to(cookieSerializer::setPartitioned); cookieSerializerCustomizers.orderedStream() .forEach((customizer) -> customizer.customize(cookieSerializer));