[NIFI-10899] Apply SameSite Attribute to Cookies

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 1.20.0
• Component/s: Core Framework, Security
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 29/Nov/22 15:36
• Updated: 05/Dec/22 19:10
• Resolved: 05/Dec/22 19:10

Description

The standard Authorization-Bearer cookie includes the SameSite attribute in the Set-Cookie response header, but other cookies for CSRF mitigation, logout processing, and external authentication service integration do not apply the attribute when setting cookies.

The Java Servlet Cookie does not support the SameSite attribute, but the NiFi StandardApplicationCookieService uses the Spring Response Cookie Builder, which supports the attribute and is capable of applying it to Set-Cookie headers. Direct use of the Java Servlet Cookie should be replaced with the implementation approach that supports setting the SameSite attribute to avoid warnings in modern browsers. In absence of the SameSite attribute, browsers default to Lax, but this can be changed to Strict in most cases.

Issue Links

• links to: GitHub Pull Request #6735