B4J Question SameSite=strict

[tchart]

On B4J Server/jServer I need to turn on SameSite = strict for cookies.

"By default Jetty uses lenient cookie security settings. In order to harden and to mitigate cross-site request forgery (CSRF) attacks, it is useful to set the SameSite=strict cookie flag. This is particularly recommended if the JSESSIONID cookie is also used directly or indirectly for authentication purposes."

Ive tried this code below but it has no affect.

Sub setSameSite()
    Dim jo As JavaObject = webserver
    jo.GetFieldJO("server").RunMethod("stop", Null)
    jo.GetFieldJO("context").RunMethodJO("getSessionHandler", Null).RunMethodJO("getSessionCookieConfig", Null).RunMethod("setComment", Array("__SAME_SITE_STRICT__"))   
    jo.GetFieldJO("server").RunMethod("start", Null)
End Sub

The session cookie still shows no tick under SameSite.

If I try this without the stop/start I get this error;

Caused by: java.lang.IllegalStateException: CookieConfig cannot be set after ServletContext is started

So I think this is the right code but perhaps not supported on our version of Jetty?

Any ideas?

 

[Erel]

I made some tests but cannot give you a definite answer. With some work you can rebuild the jServer library and add this configuration in the Start method. Might make a difference.

 

[KMatle]

Maybe not relevant, but are you using "localhost" as an address? If yes, use a real ip-address.

 

[prajinpraveen]

Apologies to bump the old thread.

Were you able to get this working. I am facing the same issue

joServer.GetFieldJO("context").RunMethodJO("getSessionHandler", Null).RunMethodJO("getSessionCookieConfig", Null).RunMethod("setComment", Array("__SAME_SITE_STRICT__"))

This doesnt seem to have any effect

thank you

 

[tchart]

Apologies to bump the old thread.

Were you able to get this working. I am facing the same issue

joServer.GetFieldJO("context").RunMethodJO("getSessionHandler", Null).RunMethodJO("getSessionCookieConfig", Null).RunMethod("setComment", Array("__SAME_SITE_STRICT__"))

This doesnt seem to have any effect

thank you

Hi apologies @prajinpraveen, I forgot to reply

Yes for jServer 3 at least this is the workaround. It does require a server stop/start. Basically what its doing is appending the value to the session cookie. This is a known workaround I found on a Jetty forum.

IMPORTANT NOTE - you need to call this after webserver.Start

Sub setSameSite()
    Dim jo As JavaObject = webserver
    jo.GetFieldJO("server").RunMethod("stop", Null)
    jo.GetFieldJO("context").RunMethodJO("getSessionHandler", Null).RunMethodJO("getSessionCookieConfig", Null).RunMethod("setPath", Array("/;SameSite=strict"))  
    jo.GetFieldJO("server").RunMethod("start", Null)
End Sub

 

[prajinpraveen]

Thank you so much. Appreciate your assistance.