Spring Security中会话cookie的同站点标志

Answer 1

新的Tomcat版本通过TomcatContextCustomizer支持SameSite Cookie。因此您应该只自定义tomcat CookieProcessor,例如,对于Spring Boot：

@Configuration
public class MvcConfiguration implements WebMvcConfigurer {
    @Bean
    public TomcatContextCustomizer sameSiteCookiesConfig() {
        return context -> {
            final Rfc6265CookieProcessor cookieProcessor = new Rfc6265CookieProcessor();
            cookieProcessor.setSameSiteCookies(SameSiteCookies.NONE.getValue());
            context.setCookieProcessor(cookieProcessor);
        };
    }
}

对于samesitecookies.none请注意，cookie也是secure（使用了SSL)，否则将无法应用它们。

默认情况下，Chrome 80 Cookie被认为是samesite=lax！

if ($scheme = http) {
    return 301 https://$http_host$request_uri;
}

proxy_cookie_path / "/; secure; SameSite=None";