Log for SameSite=None without Secure #24970
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ghost
added
the
campersau
reviewed
Aug 17, 2020
Tratcher
force-pushed
the
tratcher/samesitesecure
branch
from
c91c441 to
7f18442
Compare
Tratcher
requested review from
a team,
SteveSandersonMS and
halter73
as code owners
Member
Author
|
Rebased on release/5.0 |
Co-authored-by: campersau <[email protected]>
HaoK
approved these changes
Aug 18, 2020
|
Hello @Tratcher! Because this pull request has the p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (
|
ghost
merged commit 
amcasey
added
area-networking
This pull request was closed.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #19939 Setting
SameSite=Noneon a cookie without also settingsecurewill cause the cookie to be blocked by Chrome. This PR adds a warning log for this condition on all cookies.We don't want to modify the cookie because we don't know that our modifications will work any better. E.g. if we add
securebut the request wasn't https then it's not going to work anyways.cc: @brockallen