[SHIRO-793] deleteMe cookie should use the defined "sameSite" - ASF JIRA

Attach files

Attach Screenshot

Voters

Watch issue

Watchers

Link

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Task
Status: Resolved
Priority: Major
Resolution: Resolved
Affects Version/s: None
Fix Version/s: 1.7.0, 2.0.0-alpha
Component/s: None
Labels:
None

Description

With Chrome increasing security of cookies not defining any SameSite options, the deleteMe cookie may be blocked by Chrome under some circumstances.
For example, when an app is used within a cross-site iframe, one must defined the option SameSite=None option. This works for the main cookie, but the deleteMe is currently blocked. This commit fixes this.

https://github.com/apache/shiro/pull/257