LukeMathWalker / LukeMathWalker/biscotti
RemovalCookie should allow SameSite attribute to be set?
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
I was poking at Firefox Developer Tools, and in a page where I had used RemovalCookie to ask the client to delete a cookie, I got this message:
Cookie “______” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
In this case, when I use ResponseCookie to set it, I have been using SameSite::Strict. I guess it would make sense to be able to pass the same value here?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by comparing RemovalCookie with ResponseCookie, especially how ResponseCookie accepts SameSite::Strict. Trace the cookie attributes produced when a removal cookie is created, then confirm that the requested SameSite value is preserved in the deletion cookie, including the SameSite=None case described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100