How do I add the "samesite" attribute to JSESSION cookie

John Iliffe <[email protected]>
Newsgroups gmane.comp.apache.user
Message-ID <[email protected]>
I asked a similar question to this two weeks ago but now I have a bit more information so please
treat this as a new question.

When one of my screens (at least one) connects to a third-party web site to pass some data to them I
get warnings from Firefox about the JSSESION cookie not having the correct samesite attribute.  I
think that this cookie is generated by Apache for each session; not by me as far as I can discover.
How do I add this attribute to an automatically generated cookie?  Since there doesn't seem to be
any non-session related material in the cookie is it really needed to be passes to the remote server
at all?  The error seems to be random in the context that it only pops up once in a while and not
every time I connect.

Here is the Firefox  entry:

Cookie “JSESSIONID” will soon be rejected because it is foreign and does not have the “Partitioned“
attribute.
Cookie “JSESSIONID” does not have a proper “SameSite” attribute value. Soon, cookies without the
“SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie
will no longer be sent in third-party contexts. If your application depends on this cookie being
available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the
“SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite
card.html

Thanks.

John
======
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.