Lukasz Lenart created WW-5848:
---------------------------------
Summary: Struts Boot: make the session cookie attributes
configurable (Secure, SameSite)
Key: WW-5848
URL: https://issues.apache.org/jira/browse/WW-5848
Project: Struts 2
Issue Type: Improvement
Components: Core
Reporter: Lukasz Lenart
Follow-up to [WW-5841|https://issues.apache.org/jira/browse/WW-5841] (review of
PR [#2117|https://github.com/apache/struts/pull/2117]).
After WW-5841 the embedded Tomcat context in {{StrutsBootServer}} tracks
sessions by cookie only and sets {{SameSite=Lax}} on the session cookie through
a hard-coded {{Rfc6265CookieProcessor}}. The {{Secure}} attribute is never set.
A Boot application has no way to change either value: there is no {{web.xml}},
{{StrutsBootApplication}} exposes only {{actions(ActionRegistry)}}, and
{{BootSettings}} carries only {{struts.boot.port}}, {{struts.boot.address}} and
{{struts.boot.contextPath}}. An operator who terminates TLS in front of Boot
cannot mark the session cookie {{Secure}}, and an application that is embedded
cross-site cannot switch {{SameSite}} to {{None}}.
Proposal: two new {{struts.boot.*}} settings, read by {{BootSettings}} and
applied in {{StrutsBootServer}} next to the existing session defaults:
* {{struts.boot.session.cookie.secure}} — {{true}} or {{false}}, default
{{false}} (Boot opens a plain HTTP listener by default; a browser drops a
{{Secure}} cookie on {{http://}}). Applied via the servlet context's
{{SessionCookieConfig#setSecure}}.
* {{struts.boot.session.cookie.sameSite}} — {{lax}} (default), {{strict}},
{{none}} or {{unset}}, the values Tomcat's {{SameSiteCookies}} accepts. Applied
via {{Rfc6265CookieProcessor#setSameSiteCookies}}.
Invalid values throw a {{ConfigurationException}} naming the setting and the
value, as the other {{struts.boot.*}} settings do.
Tests owed in {{StrutsBootTomcatTest}}: the defaults stay {{SameSite=Lax}}
without {{Secure}}; {{secure=true}} adds {{Secure}}; {{sameSite=none}} and
{{sameSite=strict}} are reflected in {{Set-Cookie}}; an invalid value fails
startup. The Boot documentation page lists both settings, and
{{THREAT_MODEL.md}} §5 keeps the defaults as the framework-owned values.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
