{"action":"created","issue":{"url":"https://api.github.com/repos/netty/netty/issues/6509","repository_url":"https://api.github.com/repos/netty/netty","labels_url":"https://api.github.com/repos/netty/netty/issues/6509/labels{/name}","comments_url":"https://api.github.com/repos/netty/netty/issues/6509/comments","events_url":"https://api.github.com/repos/netty/netty/issues/6509/events","html_url":"https://github.com/netty/netty/issues/6509","id":212559584,"number":6509,"title":"[feature request] add support for SameSite cookie attribute","user":{"login":"alunny","id":48361,"avatar_url":"https://avatars0.githubusercontent.com/u/48361?v=3","gravatar_id":"","url":"https://api.github.com/users/alunny","html_url":"https://github.com/alunny","followers_url":"https://api.github.com/users/alunny/followers","following_url":"https://api.github.com/users/alunny/following{/other_user}","gists_url":"https://api.github.com/users/alunny/gists{/gist_id}","starred_url":"https://api.github.com/users/alunny/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alunny/subscriptions","organizations_url":"https://api.github.com/users/alunny/orgs","repos_url":"https://api.github.com/users/alunny/repos","events_url":"https://api.github.com/users/alunny/events{/privacy}","received_events_url":"https://api.github.com/users/alunny/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2017-03-07T21:10:05Z","updated_at":"2017-05-30T09:29:28Z","closed_at":"2017-05-30T09:29:28Z","body":"### Expected Behavior\r\n\r\nModern browsers support a new attribute `SameSite` on cookies, to mitigate CSRF attacks. From https://tools.ietf.org/html/draft-west-first-party-cookies-07\r\n\r\n> This document updates RFC6265 by defining a \"SameSite\" attribute\r\n   which allows servers to assert that a cookie ought not to be sent\r\n   along with cross-site requests.  This assertion allows user agents to\r\n   mitigate the risk of cross-origin information leakage, and provides\r\n   some protection against cross-site request forgery attacks.\r\n\r\nIt is enabled by default in Chrome 51, and has public support from Firefox: https://www.chromestatus.com/feature/4672634709082112\r\n\r\nI should be able to set the SameSite attribues (either SameSite, SameSite=lax or SameSite=strict) on netty cookies.\r\n\r\n### Actual behavior\r\n\r\nThere are no getters/setters for this attribute defined here:\r\nhttps://github.com/netty/netty/blob/4.1/codec-http/src/main/java/io/netty/handler/codec/http/cookie/Cookie.java\r\n\r\nAttempting to set this attribute in the value of the cookie results in it being (correctly) escaped."},"comment":{"url":"https://api.github.com/repos/netty/netty/issues/comments/304824220","html_url":"https://github.com/netty/netty/issues/6509#issuecomment-304824220","issue_url":"https://api.github.com/repos/netty/netty/issues/6509","id":304824220,"user":{"login":"normanmaurer","id":439362,"avatar_url":"https://avatars0.githubusercontent.com/u/439362?v=3","gravatar_id":"","url":"https://api.github.com/users/normanmaurer","html_url":"https://github.com/normanmaurer","followers_url":"https://api.github.com/users/normanmaurer/followers","following_url":"https://api.github.com/users/normanmaurer/following{/other_user}","gists_url":"https://api.github.com/users/normanmaurer/gists{/gist_id}","starred_url":"https://api.github.com/users/normanmaurer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/normanmaurer/subscriptions","organizations_url":"https://api.github.com/users/normanmaurer/orgs","repos_url":"https://api.github.com/users/normanmaurer/repos","events_url":"https://api.github.com/users/normanmaurer/events{/privacy}","received_events_url":"https://api.github.com/users/normanmaurer/received_events","type":"User","site_admin":false},"created_at":"2017-05-30T09:29:28Z","updated_at":"2017-05-30T09:29:28Z","body":"Let me close this for now... We can re-evolate once we start working on next major version"}}
{"actor":{"display_login":"normanmaurer"}}