Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Require "Secure" for "SameSite=None". #1323

Merged
merged 6 commits into from
Dec 2, 2020
Merged

Require "Secure" for "SameSite=None". #1323

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1379480
Treat cookies as "SameSite=Lax" by default.
miketaylr Oct 14, 2020
0001e89
Update non-normative language to mention default Lax-like enforcement.
miketaylr Nov 25, 2020
ae49319
Require "Secure" for "SameSite=None".
miketaylr Oct 14, 2020
d241895
Update changelog for Secure-"SameSite=None"
miketaylr Nov 25, 2020
c918432
Merge branch 'master' into samesite-none-secure
mikewest Dec 2, 2020
0924992
Update draft-ietf-httpbis-rfc6265bis.md
mikewest Dec 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
Prev Previous commit
Next Next commit
Update non-normative language to mention default Lax-like enforcement. 
Also update the changelog.
  • Loading branch information
@miketaylr
miketaylr committed Nov 25, 2020
commit 0001e898e485dbba28198eda727b5f7e6c082979
6 changes: 5 additions & 1 deletion draft-ietf-httpbis-rfc6265bis.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -661,7 +661,7 @@ with same-site requests, and with "cross-site" top-level navigations, as
described in {{strict-lax}}. If the value is "None", the cookie will be sent
with same-site and cross-site requests. If the "SameSite" attribute's value is
something other than these three known keywords, the attribute's value will be
treated as "None".
subject to a default enforcement mode that is equivalent to "Lax".

The "SameSite" attribute affects cookie creation as well as delivery. Cookies
which assert "SameSite=Lax" or "SameSite=Strict" cannot be set in responses to
Expand Down Expand Up @@ -2167,6 +2167,10 @@ The "Cookie Attribute Registry" will be updated with the registrations below:
created without parsing a cookie string:
<https://github.com/httpwg/http-extensions/issues/1234>.

* Add a default enforcement value to the `same-site-flag`, equivalent to
"SameSite=Lax":
<https://github.com/httpwg/http-extensions/pull/1325>.

# Acknowledgements
{:numbered="false"}
RFC 6265 was written by Adam Barth. This document is a minor update of
Expand Down