While upgrading to SB 4.1 I've spotted a strange behaviour (currently I have tests that tests the sameSite attribute on cookie serializer)
In springboot 4 the DefaultCookieSerializer is built with its sameSite attribute set to Lax.
Hwever, in SessionAutoConfiguration, we can see that PropertyMapper does not filter null values as it used to do and sets the sameSite attribute to the value read from properties, regardless to the fact that it might be null in properties.
In previous version, the property mapper used to be built with a setting of value non null.
I fear that it might change default behaviour for application not setting the server.servlet.session.cookie.same-site property.
While upgrading to SB 4.1 I've spotted a strange behaviour (currently I have tests that tests the sameSite attribute on cookie serializer)
In springboot 4 the
DefaultCookieSerializeris built with itssameSiteattribute set toLax.Hwever, in SessionAutoConfiguration, we can see that
PropertyMapperdoes not filter null values as it used to do and sets thesameSiteattribute to the value read from properties, regardless to the fact that it might be null in properties.In previous version, the property mapper used to be built with a setting of value non null.
I fear that it might change default behaviour for application not setting the
server.servlet.session.cookie.same-siteproperty.