LukeMathWalker / LukeMathWalker/biscotti

RemovalCookie should allow SameSite attribute to be set?

Open
#7 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
125
Forks
2
PR merge metrics
No merged PRs in 30d

Description

I was poking at Firefox Developer Tools, and in a page where I had used RemovalCookie to ask the client to delete a cookie, I got this message:

Cookie “______” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

In this case, when I use ResponseCookie to set it, I have been using SameSite::Strict. I guess it would make sense to be able to pass the same value here?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by comparing RemovalCookie with ResponseCookie, especially how ResponseCookie accepts SameSite::Strict. Trace the cookie attributes produced when a removal cookie is created, then confirm that the requested SameSite value is preserved in the deletion cookie, including the SameSite=None case described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.