New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Require "Secure" for "SameSite=None". #1323
Conversation
Can you please review, @chlily1? |
LGTM, thanks |
cc @mikewest |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM % changelog entry.
0edf386
to
d241895
Compare
On a gamble, I just rebased this on top of #1325 (to avoid Changelog merge conflicts). So that should land first before merging this. |
Hrm. Landing #1325 created conflicts here. I'll resolve those and land this PR this morning. |
My bad. 😿 (Thanks for fixing!) |
SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f
SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289}
SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289}
SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289}
…s, a=testonly Automatic update from web-platform-tests Remove legacy-samesite Web Platform Tests SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289} -- wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68 wpt-pr: 29758
…s, a=testonly Automatic update from web-platform-tests Remove legacy-samesite Web Platform Tests SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289} -- wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68 wpt-pr: 29758
…s, a=testonly Automatic update from web-platform-tests Remove legacy-samesite Web Platform Tests SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289} -- wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68 wpt-pr: 29758
…s, a=testonly Automatic update from web-platform-tests Remove legacy-samesite Web Platform Tests SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289} -- wpt-commits: 939731a4f020de9afac2c4bf8c4de67eb9992e68 wpt-pr: 29758
SameSite-Lax-by-default and SameSite=None-requires-Secure have been standardized ([1], [2]) and launched in Chromium [3] as well as Firefox [4]. The WPTs testing "legacy" behavior are no longer needed, and they are also failing on wpt.fyi [5]. This change removes the legacy-samesite virtual test suite, as well as the ?legacy-samesite variant of the tests in wpt/cookie/samesite/. The test for SameSite=None-requires-Secure also loses its "tentative" designation. Chromium will soon no longer support the configuration used in the virtual test suite, so there would be no way to run these tests anyway. [1] httpwg/http-extensions#1325 [2] httpwg/http-extensions#1323 [3] https://crrev.com/c/2231445 [4] https://hacks.mozilla.org/2020/08/changes-to-samesite-cookie-behavior/ [5] https://wpt.fyi/results/cookies/samesite?run_id=5099687737556992&run_id=5641857632567296&run_id=5678463840157696&run_id=5638004375814144 Bug: 961439, 1211388 Change-Id: Idb3c835908bcd61dde3593b4fb4f9349e738031f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3047679 Reviewed-by: Steven Bingler <[email protected]> Commit-Queue: Lily Chen <[email protected]> Cr-Commit-Position: refs/heads/master@{#905289} NOKEYCHECK=True GitOrigin-RevId: a11b13cf0fb388ee424f03814c955052856331ad
Opening for discussion, per the last interim group meeting.
This should correspond to https://tools.ietf.org/html/draft-west-cookie-incrementalism-01#section-3.2