projects / arvados.git / commit
summary | shortlog | log | commit | commitdiff | tree
(parent: ea3f1b8) | patch
17202: Use explicit SameSite=Lax for 303-with-cookie.
authorTom Clegg <tom@tomclegg.ca>
Wed, 9 Dec 2020 14:34:14 +0000 (09:34 -0500)
committerPeter Amstutz <peter.amstutz@curii.com>
Mon, 22 Feb 2021 19:02:35 +0000 (14:02 -0500)
commitec67645272eecd27cedd04d7a79062d5d8f02f98
treed60a9abe9aecb4479c04a7bce0a979d4406c19catree | snapshot
parentea3f1b8246c27a6a44edfc561f13935ef377c1cbcommit | diff
17202: Use explicit SameSite=Lax for 303-with-cookie.

This improves XSS protection on some browsers, including Safari and
Firefox for Android.

On most browsers, Lax is already the default.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@tomclegg.ca>
services/keep-web/handler.go diff | blob | history