How to set samesite cookie on WildFly 20?

Question

I need to set same site cookie attribute to Strict on WildFly20 server responses. I need to do it via server configuration. Any help ??

Mustang

Did you got help? I would have the same issue – Transfigure

Please refer wildfly.org/news/2020/05/04/WildFly-1910-Released – Mustang

Answer 1

JMart's answer is correct but requires to add a file to your web-application (undertow-handlers.conf). With WildFly 19.1 (WFLY-13003) and above you can configure this feature in WildFly's standalone.xml as follows:

<subsystem xmlns="urn:jboss:domain:undertow:12.0" ...>
    <server name="default-server">
        ...
        <host name="default-host" alias="localhost">
            <location name="/" handler="welcome-content"/>
            <http-invoker http-authentication-factory="application-http-authentication"/>
            <!-- add the filter defined below -->
            <filter-ref name="samesite-cookie"/>
        </host>
    </server>
    ...
    <filters>
        <!-- configure samesite handler -->
        <expression-filter name="samesite-cookie" expression="samesite-cookie(mode=strict)"/>
    </filters>
</subsystem>

This can be achieved by executing the following commands via WildFly's CLI interface:

/subsystem=undertow/configuration=filter/expression-filter=samesite-cookie:add(expression="samesite-cookie(mode=strict)")
/subsystem=undertow/server=default-server/host=default-host/filter-ref=samesite-cookie:add

Environmentalist

This is a better alternative. +1 – Applicatory

I believe in the above you meant standalone.xml rather than standalone.conf – Bainite

Answer 2

As from WildFly19 you an add a handler to tune samesite cookie attributes.

The only thing you have to do is to add a file "undertow-handlers.conf" into your WEB-INF (or META-INF) folder.

The content of the handler could be something like this (i.e. to set mode to Lax):

samesite-cookie(mode=Lax, enable-client-checker=true, cookie-pattern=*)

The syntax is very flexible. In the above example the "enable-client-checker" and "cookie-pattern" parameters are optional.

You can take a look at Undertow feature announcement and at SameSiteCookieHandler javadoc to further understand.

You can also take a look at the Wildfly feature request, which explains the issue.

Darcie