增加 sessionIdCookieSameSite 参数

melodyjerry · Apr 12, 2021 · 4e16ddc · 4e16ddc
1 parent 8ecff6b
commit 4e16ddc
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/modules/core/src/main/java/com/jeesite/common/shiro/filter/FormAuthenticationFilter.java b/modules/core/src/main/java/com/jeesite/common/shiro/filter/FormAuthenticationFilter.java
@@ -21,6 +21,7 @@
 import org.apache.shiro.subject.Subject;
 import org.apache.shiro.web.servlet.Cookie;
 import org.apache.shiro.web.servlet.SimpleCookie;
+import org.apache.shiro.web.servlet.Cookie.SameSiteOptions;
 import org.apache.shiro.web.util.WebUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -69,6 +70,8 @@ public FormAuthenticationFilter() {
 		rememberUserCodeCookie.setName(REMEMBER_USERCODE_PARAM);
 		rememberUserCodeCookie.setPath(Global.getProperty("session.sessionIdCookiePath"));
 		rememberUserCodeCookie.setSecure(Global.getPropertyToBoolean("session.sessionIdCookieSecure", "false"));
+		rememberUserCodeCookie.setHttpOnly(Global.getPropertyToBoolean("session.sessionIdCookieHttpOnly", "true"));
+		rememberUserCodeCookie.setSameSite(SameSiteOptions.valueOf(Global.getProperty("session.sessionIdCookieSameSite", "LAX")));
         instance = this;
 	}
 

diff --git a/modules/core/src/main/resources/config/jeesite-core.yml b/modules/core/src/main/resources/config/jeesite-core.yml
@@ -455,10 +455,11 @@ session:
   # 共享的SessionId的Cookie名称，保存到跟路径下，第三方应用获取。同一域名下多个项目时需设置共享Cookie的名称。
   #shareSessionIdCookieName: ${session.sessionIdCookieName}
 
-  # 仅在 HTTPS 下通信 Cookie 数据
-  #session.sessionIdCookieSecure: false
-  #session.sessionIdCookieHttpOnly: true
-
+  # 其它 SimpleCookie 参数（v4.2.3）
+  #sessionIdCookieSecure: false
+  #sessionIdCookieHttpOnly: true
+  #sessionIdCookieSameSite: LAX
+
   # 设置接收SessionId请求参数的名称
   sessionIdParamName: __sid