Conversation
jaitaiwan
left a comment
There was a problem hiding this comment.
From what I read of your linked comments, it seems like we should set the default to "None" for backwards compatible behaviour.
|
I think that's a good idea. We can release it under a major version tag so it doesn't break folk's installations either way. |
|
LGTM - Just waiting for scanning/tests to finish |
|
@jaitaiwan I believe vulncheck issues are unrelated and we can tackle them separately. Can you help? |
|
The linter is passing for me as well. I think this could be a false positive, I can't even find the existence of |
|
We'll merge this once we've fixed #277 I think |
|
I think this might be missing from v1.4.0 can you check @bharat-rajani or @apoorvajagtap ? |
|
@jaitaiwan the new default |
What type of PR is this? (check all applicable)
Description
This PR sets the SameSite cookie attribute to Lax in the Set-Cookie header. The SameSite=Lax value provides a reasonable balance between security and usability for websites.
Reference:
https://owasp.org/www-community/SameSite
Related Tickets & Documents
Added/updated tests?
have not been included
Run verifications and test
make verifyis passingmake testis passingFixes: #256