adding sameSite cookie attr support to samples#166
Conversation
sangonzal
left a comment
sangonzal
left a comment
There was a problem hiding this comment.
These changes should also be made in AzureSamples samples and to the portal quickstart. Also a wiki page explaining these changes which all the samples can point to would be useful.
| aad.redirectUri=https://localhost:8081/msal4jsample/secure/aad | ||
| aad.oboApi=<OboAi>/access_as_user | ||
|
|
||
| server.servlet.session.cookie.secure=true |
There was a problem hiding this comment.
Is secure cookie necessary as part of the SameSite changes?
I realize that this is a necessary practice in a production app, but it had been omitted in this samples previously because it further complicates getting the sample running. For the Azure Samples and the portal quickstart, these changes will have to be explained, including instructions on how to set this up. IMO a section in the README and in a comment in the code could be sufficient.
There was a problem hiding this comment.
In new versions of Chrome cookies with same site none will not be included in cs request if they not secure
@SomkaPe Adding to @sangonzal comment: Please prioritize adding these changes to the Azure Samples here: These are the customer facing samples we promote through docs etc. |
|
@navyasric Corresponding PR were submitted, please review |
| if (responseCode != HttpURLConnection.HTTP_OK) { | ||
| is = conn.getErrorStream(); | ||
| if (is != null) { | ||
| httpResponse.headers(conn.getHeaderFields()); |
There was a problem hiding this comment.
ields()); [](start = 56, length = 9)
was this a bug? Seems like there is a test missing?
There was a problem hiding this comment.
yes, bug - headers were not returned in case of error, missed test class during commit , will add
| @@ -0,0 +1,95 @@ | |||
| // Copyright (c) Microsoft Corporation. All rights reserved. | |||
There was a problem hiding this comment.
why is this not shared code across samples?
There was a problem hiding this comment.
technically all samples are different projects,
4 participants
samples updated to support "SameSite" attribute of session cookies: