PerfectlySoft / PerfectlySoft/Perfect-Session
Session cookie cannot be configured without "sameSite" cookie attribute.
Nobody has claimed this yet.
- Dominant language
- Swift
- Stars
- 4
- Forks
- 14
- Avg merge
- 17m
- Merged PRs (30d)
- 1
Description
In the SessionConfig structure it is necessary to select a sameSite cookie policy (Strict or Lax). However, certain use cases or workarounds require avoiding the sameSite cookie attribute altogether. For example, in iOS 12 / Mojave, OAuth flows based on a session cookie with a sameSite cookie policy cannot work due to a bug in CFNetwork (https://bugs.webkit.org/show_bug.cgi?id=188165).
It would be good if the SessionConfig structure would list cookieSameSite as an optional field. PerfectHTTP's addCookie method already allows configuring a cookie without the sameSite attribute.
Unfortunately, it is not easily possible to work around this limitation in the app by using a response filter that re-writes the session cookie with the desired flags, as the HTTPResponse's header function only exposes one of the Set-Cookie headers.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the SessionConfig structure and the session-cookie creation path, then compare its options with PerfectHTTP's addCookie behavior. Make cookieSameSite optional so the SameSite attribute can be omitted, and verify that session cookies still support Strict and Lax policies as well as no SameSite attribute.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100