How to set same-site cookie flag in Spring Boot?

Setting the SameSite cookie attribute in Spring Boot is an important security measure that helps prevent Cross-Site Request Forgery (CSRF) attacks. The SameSite cookie attribute can be set to one of three values: Strict, Lax, or None.

1. Strict: The strictest setting. The cookie is only sent when the request originates from the same site, meaning that even requests initiated via a standard link from another site will not include the cookie.
2. Lax: A slightly less strict setting. For some GET requests, the cookie is sent even if the request originates from another site, such as when a user clicks a link from another site to access the page.
3. None: No restrictions; the cookie is sent for cross-site requests as long as a secure connection (HTTPS) is used.

Setting the SameSite Attribute in Spring Boot

In a Spring Boot application, you can set the SameSite attribute in multiple ways. Below are several common methods:

Method 1: Using Cookie Serializer

If you use Spring Session to manage sessions, you can set the SameSite attribute by customizing DefaultCookieSerializer.

java
import org.springframework.context.annotation.Bean;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;

@Configuration
public class HttpSessionConfig {

    @Bean
    public CookieSerializer cookieSerializer() {
        DefaultCookieSerializer serializer = new DefaultCookieSerializer();
        serializer.setSameSite("Lax"); // Set to Lax, Strict, or None
        return serializer;
    }
}

Method 2: Setting via Response Interceptor

You can also create a HandlerInterceptor to modify the cookie attributes in the response.

java
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.stereotype.Component;
import org.springframework.web.servlet.HandlerInterceptor;

@Component
public class SameSiteInterceptor implements HandlerInterceptor {

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
                           ModelAndView modelAndView) throws Exception {
        for (Cookie cookie : response.getCookies()) {
            String cookieHeader = String.format("%s=%s; SameSite=Lax", cookie.getName(), cookie.getValue());
            response.setHeader("Set-Cookie", cookieHeader);
        }
    }
}

// Register the interceptor
@Configuration
public class WebMvcConfig implements WebMvcConfigurer {

    @Autowired
    private SameSiteInterceptor sameSiteInterceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(sameSiteInterceptor);
    }
}

Method 3: Setting in Nginx or Other Reverse Proxy

If you have a reverse proxy like Nginx in front of your application, you can set the SameSite attribute there.

nginx
proxy_cookie_path / "/; SameSite=Lax";

These are several methods to set the SameSite cookie attribute in a Spring Boot application. Depending on your specific requirements and deployment environment, you can choose the most suitable one.