ring-clojure / ring-clojure/ring
Use two session cookies for safe and unsafe requests
Nobody has claimed this yet.
- Dominant language
- Clojure
- Stars
- 3.9k
- Forks
- 528
- PR merge metrics
- No merged PRs in 30d
Description
SameSite=strict cookies are only sent for requests from a first-party context. SameSite=lax cookies are sent for first-party requests, as well as for top-level navigations. If you use only a single cookie then it probably needs to be SameSite=lax to support navigating to a site from a third-party site or email link (Gmail wraps all links in a redirect through a URL checker).
I wondered if it could be good for a new option in wrap-session to set and read two kinds of cookies? ring-session-safe; SameSite=lax which would be used for GET/HEAD requests, and ring-session-unsafe; SameSite=strict which would be used for PUT/POST/DELETE/PATCH requests.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the wrap-session entry point and inspect how session cookies are currently set and read. Define the option's configuration and method-specific behavior for safe versus unsafe requests, then add tests covering SameSite attributes, cookie selection, and the existing single-cookie behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- clojure
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100