Question

请原谅我缺乏结构/礼节，这是我的第一篇文章。

我有一个使用Spring Boot（v2.1.6）的Java应用程序，具有基于注释的spring-boot-starter-security配置，并且无法理解如何添加以下内容的响应标头：

 "Set-Cookie: SameSite=strict"

解决警告：

A cookie associated with a cross-site resource at "myApiUrl" was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

下面列出了我的HttpSecurity的完整配置，我试图使用StaticHeadersWriter这样在配置的最后部分添加标头：

@Override
protected void configure(HttpSecurity http) throws Exception { 
    http
    .csrf().disable()
    .cors()
    .and()
        .exceptionHandling()
        .authenticationEntryPoint(entryPoint) //request is generally sent to entry point when unauthorized
    .and()
    .authorizeRequests()
        .antMatchers("/loggedIn").permitAll()
        .antMatchers("/createUser").permitAll()
        .antMatchers("/deleteUser").hasRole("ADMIN")
        .antMatchers("/fullDB").hasRole("ADMIN")
        .antMatchers("/logs").hasRole("ADMIN")
        .antMatchers("/**").authenticated()
    .and()
    .formLogin()
        .successHandler(new AuthenticationSuccessHandler())
        .failureHandler(new SimpleUrlAuthenticationFailureHandler())
    .and()
    .logout()
        .deleteCookies(cookieName)
        .invalidateHttpSession(true)
        .logoutUrl("/logout")
        .logoutSuccessHandler((new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)))
    .and()
        .headers()
        .addHeaderWriter(new StaticHeadersWriter("Set-Cookie", "SameSite=strict"))
        .addHeaderWriter(new StaticHeadersWriter("A-cookie","B=val"))
        .addHeaderWriter(new StaticHeadersWriter("SetCookie","SameSitestrict"));
}

使用以下配置，除Set-Cookie标头外，每个标头都能收到有效的响应，该标头似乎已被删除，可以在下面的链接中看到。

Image of Response

我尝试解决此问题的其他尝试包括在所提供的successHandler（）中添加到自定义url端点的重定向，然后将返回一个ResponseEntity，我可以在其中提供以下代码，但是这些尝试也不会包括“ Set-Cookie”响应标头。

   HttpHeaders httpHeaders = new HttpHeaders();
   httpHeaders.add(HttpHeaders.SET_COOKIE, "SomeName=someId");
   return new ResponseEntity(httpHeaders, HttpStatus.OK);

 or

   response.addCookie(new Cookie("SomeName", "someId"));
   return ResponseEntity.ok().build();

任何有关如何在Spring Boot API调用的响应中提供“ Set-Cookie”标头来解决此镶边警告的建议，将不胜感激！

Spring Boot 2 Set-Cookie响应头丢失

0 个答案: