如何在 JSESSIONID Cookie 中设置 SameSite=None

如何解决如何在 JSESSIONID Cookie 中设置 SameSite=None

我在 Heroku 上托管了一个 Spring Boot API，当我尝试通过 Google Chrome 中的 Angular 应用程序访问它时（在 Firefox 中它工作正常），我面临以下问题：

JSESSIONID cookie 似乎被阻止了，因为它没有设置为 SameSite=None。但是如何将其设置为 SameSite=None？

以下是我的配置类：

安全配置：

@Configuration
@EnableWebSecurity
@Order(SecurityProperties.DEFAULT_FILTER_ORDER)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private ClienteUserDetailsService clienteUserDetailsService;

    private static final String[] PUBLIC_MATCHERS = {"/login","/logout","/error.html","/error"};

    private static final String[] PUBLIC_MATCHERS_GET = {"/login","/error"};

    private static final String[] PUBLIC_MATCHERS_POST = {"/login","/logout"};

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().disable()
                .authorizeRequests()
                .antMatchers(HttpMethod.POST,PUBLIC_MATCHERS_POST).permitAll()
                .antMatchers(HttpMethod.GET,PUBLIC_MATCHERS_GET).permitAll()
                .antMatchers(PUBLIC_MATCHERS).permitAll()
                .antMatchers(HttpMethod.OPTIONS,"/**").permitAll()
                .anyRequest().authenticated()
                .and().formLogin()
                .and().httpBasic()
                .and().logout().logoutUrl("/logout").logoutSuccessHandler((new HttpStatusReturninglogoutSuccessHandler(HttpStatus.OK)))
                .clearauthentication(true).invalidateHttpSession(true)
                .deleteCookies("JSESSIONID","XSRF-TOKEN");
    }

    private CsrftokenRepository getCsrftokenRepository() {
        CookieCsrftokenRepository tokenRepository = CookieCsrftokenRepository.withHttpOnlyFalse();
        tokenRepository.setCookiePath("/");
        return tokenRepository;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder builder) throws Exception {
        builder.userDetailsService(clienteUserDetailsService)
                .passwordEncoder(passwordEncoder());
    }

    @Bean
    public WebMvcConfigurer corsConfigurer() {
        return new WebMvcConfigurerAdapter() {
            @Override
            public void addCorsMappings(CorsRegistry registry) {
                registry.addMapping("**")
                        .allowedOrigins("http://localhost:4200","https://dogwalk-teste.web.app")
                        .allowedMethods("POST,GET,PUT,OPTIONS,DELETE,PATCH")
                        .allowCredentials(true);
            }
        };
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
   

}

CorsFilter：

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class CorsFilter implements Filter {

    @Context
    public void doFilter(ServletRequest req,ServletResponse res,FilterChain chain)
            throws IOException,servletexception {

        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;

        response.setHeader("Access-Control-Allow-Origin",request.getHeader("Origin"));
        response.setHeader("Access-Control-Allow-Credentials","true");
        response.setHeader("Access-Control-Allow-Methods","POST,PATCH");
        response.setHeader("Access-Control-Max-Age","3600");
        response.setHeader("Access-Control-Allow-Headers","X-PINGOTHER,Content-Type,X-Requested-With,Accept,Origin,Access-Control-Request-Method,"
                + "Access-Control-Request-Headers,Authorization,if-modified-since,remember-me,"
                + "x-csrf-token,x-xsrf-token,xsrf-token ");
        response.addheader("Access-Control-Expose-Headers","xsrf-token");
        response.addheader("Access-Control-Allow-Headers","x-csrf-token,x-xsrf-token");
        response.setHeader("Set-Cookie","locale=pt-BR; HttpOnly; Secure; SameSite=None;");

        chain.doFilter(req,res);
    }

    @Override
    public void init(FilterConfig filterConfig) throws servletexception {
    }

    @Override
    public void destroy() {
    }
}

解决方法

在基本身份验证的情况下，在控制器返回响应对象后立即刷新/提交响应，在调用 SameSiteFilter#addSameSiteCookieAttribute 之前。

您需要在创建会话后立即包装请求并调整 cookie。您可以通过定义以下类来实现它：

一个 bean（如果你想把所有东西都放在一个地方，你可以在 SecurityConfig 中定义它。为了简洁，我只是在上面加上了 @Component 注释）

package com.dogwalk.dogwalk.config;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.web.firewall.FirewalledRequest;
import org.springframework.security.web.firewall.HttpFirewall;
import org.springframework.security.web.firewall.RequestRejectedException;
import org.springframework.stereotype.Component;

@Component
public class MyHttpFirewall implements HttpFirewall {

    @Override
    public FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException {
        return new RequestWrapper(request);
    }

    @Override
    public HttpServletResponse getFirewalledResponse(HttpServletResponse response) {
        return new ResponseWrapper(response);
    }

}

第一个包装类

package com.dogwalk.dogwalk.config;

import java.util.Collection;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import org.springframework.http.HttpHeaders;
import org.springframework.security.web.firewall.FirewalledRequest;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

/**
 * Wrapper around HttpServletRequest that overwrites Set-Cookie response header and adds SameSite=None portion.
 */
public class RequestWrapper extends FirewalledRequest {

    /**
     * Constructs a request object wrapping the given request.
     *
     * @param request The request to wrap
     * @throws IllegalArgumentException if the request is null
     */
    public RequestWrapper(HttpServletRequest request) {
        super(request);
    }

    /**
     * Must be empty by default in Spring Boot. See FirewalledRequest.
     */
    @Override
    public void reset() {
    }

    @Override
    public HttpSession getSession(boolean create) {
        HttpSession session = super.getSession(create);

        if (create) {
            ServletRequestAttributes ra = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
            if (ra != null) {
                overwriteSetCookie(ra.getResponse());
            }
        }

        return session;
    }

    @Override
    public String changeSessionId() {
        String newSessionId = super.changeSessionId();
        ServletRequestAttributes ra = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        if (ra != null) {
            overwriteSetCookie(ra.getResponse());
        }
        return newSessionId;
    }

    private void overwriteSetCookie(HttpServletResponse response) {
        if (response != null) {
            Collection<String> headers = response.getHeaders(HttpHeaders.SET_COOKIE);
            boolean firstHeader = true;
            for (String header : headers) { // there can be multiple Set-Cookie attributes
                if (firstHeader) {
                    response.setHeader(HttpHeaders.SET_COOKIE,String.format("%s; %s",header,"SameSite=None")); // set
                    firstHeader = false;
                    continue;
                }
                response.addHeader(HttpHeaders.SET_COOKIE,"SameSite=None")); // add
            }
        }
    }
}

第二个包装类

package com.dogwalk.dogwalk.config;

import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpServletResponseWrapper;

/**
 * Dummy implementation.
 * To be aligned with RequestWrapper.
 */
public class ResponseWrapper extends HttpServletResponseWrapper {
    /**
     * Constructs a response adaptor wrapping the given response.
     *
     * @param response The response to be wrapped
     * @throws IllegalArgumentException if the response is null
     */
    public ResponseWrapper(HttpServletResponse response) {
        super(response);
    }
}

最后，您可以删除过时的 SameSiteFilter，因为所有工作都将在 RequestWrapper#overwriteSetCookie 中完成。

注意 Postman 不渲染/支持 Cookies 部分下的 SameSite cookie 属性。您需要查看 Set-Cookie 响应头或使用 curl。