CODEWITHSUNDEEP
scalagoogle-chromecookiesplayframeworksamesite
Jordan Shaw
Jordan Shaw

Reputation: 559

Play Framework version 2.6/2.7 set PLAY_SESSION cookie to SameSite=None; Secure

There's many posts confirming that play supports the SameSite=None; Secure requirement. However when configuring the session through config like this:

    ...
    play.http.session.httpOnly=true
    play.http.session.sameSite="None"
    play.http.session.secure=true
    ...

Chrome tells me that None is not getting set. See below: samesitecookie

To validate I'm on the right back-ported version(2.6.24) I implemented a filter to set other cookies I have control over and when I construct a cookie manually like this:

   Cookie(
      key,
      value,
      secure = true,
      sameSite = Some(Cookie.SameSite.None)
    )

Chrome will show that SameSite=None; Secure does get set on those cookies. Which makes me think there's something with the config implementation that is not understanding None the play docs indicate you can only pass Strict or Lax as well but I was hoping that was just a documentation error.

EDIT: Confirmed cbley answer 2.6.25 works see below screen shot enter image description here

Upvotes: 0

Views: 1071

Answers (1)

cbley
cbley

Reputation: 4608

This is fixed in Play versions 2.6.25 and 2.7.5.

Upvotes: 1

Related Questions