Package net.shibboleth.shared.spring.servlet.impl

Class SameSiteCookieHeaderFilter

java.lang.Object

net.shibboleth.shared.servlet.AbstractConditionalFilter

net.shibboleth.shared.spring.servlet.impl.SameSiteCookieHeaderFilter

All Implemented Interfaces:

Filter, ChainableFilter, Ordered

public class SameSiteCookieHeaderFilter
extends AbstractConditionalFilter
implements ChainableFilter

Implementation of Filter which adds the SameSite attribute to cookies, until the Java API supports it natively, if ever.

Explicitly named cookies are configured and placed into a Map of cookie name to same-site attribute value.

All other cookies may be assigned a default value.

Cookies with an existing same-site cookie flag are left unaltered - copied back into the response without modification.

A single cookie can only have at most one same-site value set. Attempts in the configuration to give more than one same-site value to a cookie are caught during argument injection and throw an IllegalArgumentException.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private class	SameSiteCookieHeaderFilter.SameSiteResponseProxy	An implementation of the HttpServletResponse which adds the same-site flag to Set-Cookie headers for the set of configured cookies.
static enum	SameSiteCookieHeaderFilter.SameSiteValue	The allowed same-site cookie attribute values.

Nested classes/interfaces inherited from interface net.shibboleth.shared.spring.servlet.ChainableFilter

ChainableFilter.FilterOrder

Field Summary

Fields

Modifier and Type	Field	Description
private SameSiteCookieHeaderFilter.SameSiteValue	defaultValue	Optional default value to apply.
private final org.slf4j.Logger	log	Class logger.
private static final String	SAMESITE_ATTRIBITE_NAME	The name of the same-site cookie attribute.
private Map<String,SameSiteCookieHeaderFilter.SameSiteValue>	sameSiteCookies	Map of cookie name to same-site attribute value.

Fields inherited from interface org.springframework.core.Ordered

HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE

Constructor Summary

Constructors

Constructor	Description
SameSiteCookieHeaderFilter()	Constructor.

Method Summary

Modifier and Type	Method	Description
void	destroy()
int	getOrder()
void	init(FilterConfig filterConfig)
protected void	runFilter(ServletRequest request, ServletResponse response, FilterChain chain)	Subclasses should override this method to be called when the filter is directed to activate.
void	setDefaultValue(SameSiteCookieHeaderFilter.SameSiteValue value)	Set an optional default value to apply to all unmapped cookies.
void	setSameSiteCookies(Map<SameSiteCookieHeaderFilter.SameSiteValue,List<String>> map)	Set the names of cookies to add the same-site attribute to.

Methods inherited from class net.shibboleth.shared.servlet.AbstractConditionalFilter

doFilter, getActivationCondition, setActivationCondition

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface jakarta.servlet.Filter

doFilter

Field Details

SAMESITE_ATTRIBITE_NAME

@Nonnull
@NotEmpty
private static final String SAMESITE_ATTRIBITE_NAME

The name of the same-site cookie attribute.

See Also:

• Constant Field Values

log

@Nonnull
private final org.slf4j.Logger log

Class logger.

defaultValue

@Nullable
private SameSiteCookieHeaderFilter.SameSiteValue defaultValue

Optional default value to apply.

sameSiteCookies

@Nonnull
private Map<String,SameSiteCookieHeaderFilter.SameSiteValue> sameSiteCookies

Map of cookie name to same-site attribute value.

Constructor Details

SameSiteCookieHeaderFilter

public SameSiteCookieHeaderFilter()

Constructor.

Method Details

setDefaultValue

public void setDefaultValue(@Nullable
 SameSiteCookieHeaderFilter.SameSiteValue value)

Set an optional default value to apply to all unmapped cookies.

Parameters:

value - default value

setSameSiteCookies

public void setSameSiteCookies(@Nullable
 Map<SameSiteCookieHeaderFilter.SameSiteValue,List<String>> map)

Set the names of cookies to add the same-site attribute to.

The argument map is flattened to remove the nested collection. The argument map allows duplicate cookie names to appear in order to detect configuration errors which would otherwise not be found during argument injection e.g. trying to set a session identifier cookie as both SameSite=Strict and SameSite=None. Instead, duplicates are detected here, throwing a terminating IllegalArgumentException if found.

Parameters:

map - the map of same-site attribute values to cookie names.

init

public void init(FilterConfig filterConfig)
          throws ServletException

Specified by:

init in interface Filter

Overrides:

init in class AbstractConditionalFilter

Throws:

ServletException

destroy

public void destroy()

Specified by:

destroy in interface Filter

Overrides:

destroy in class AbstractConditionalFilter

getOrder

public int getOrder()

Specified by:

getOrder in interface ChainableFilter

Specified by:

getOrder in interface Ordered

runFilter

protected void runFilter(@Nonnull
 ServletRequest request,
 @Nonnull
 ServletResponse response,
 @Nonnull
 FilterChain chain)
                  throws IOException,
ServletException

Subclasses should override this method to be called when the filter is directed to activate.

Specified by:

runFilter in class AbstractConditionalFilter

Parameters:

request - servlet request

response - servlet response

chain - filter chain

Throws:

IOException - on error

ServletException - on error