讨论区 » AAS-V10敏捷版 »
设置samesite 属性,防止跨域
由 徐 田汉 在 将近 3 年 之前添加
设置samesite 属性,是解决跨域问题的一种:
修改 conf/context.xml 添加 <Context> <CookieProcessor sameSiteCookies="xxx" /> </Context>
value取值有四种:unset,none,lax,strict,可参考如下说明:
<attribute name="sameSiteCookies" required="false">
<p>Enables setting same-site cookie attribute.</p>
<p>If value is <code>unset</code> then the same-site cookie attribute
won't be set. This is the default value.</p>
<p>If value is <code>none</code> then the same-site cookie attribute
will be set and the cookie will always be sent in cross-site requests.</p>
<p>If value is <code>lax</code> then the browser only sends the cookie
in same-site requests and cross-site top level GET requests.</p>
<p>If value is <code>strict</code> then the browser prevents sending the
cookie in any cross-site request.</p>
</attribute>