项目

一般

简介

设置samesite 属性,防止跨域

由 徐 田汉 在 将近 3 年 之前添加

设置samesite 属性,是解决跨域问题的一种:
修改 conf/context.xml 添加 <Context> <CookieProcessor sameSiteCookies="xxx" /> </Context>

value取值有四种:unset,none,lax,strict,可参考如下说明:

<attribute name="sameSiteCookies" required="false">
        <p>Enables setting same-site cookie attribute.</p>

        <p>If value is <code>unset</code> then the same-site cookie attribute
        won't be set. This is the default value.</p>

        <p>If value is <code>none</code> then the same-site cookie attribute
        will be set and the cookie will always be sent in cross-site requests.</p>

        <p>If value is <code>lax</code> then the browser only sends the cookie
        in same-site requests and cross-site top level GET requests.</p>

        <p>If value is <code>strict</code> then the browser prevents sending the
        cookie in any cross-site request.</p>
</attribute>