Question

使用“应用程序”选项卡中的内置开发人员工具，我看不到SameSite = Strict。

我在Apache配置中的标头代码下方添加了

Header always edit Set-Cookie (.*) "$1;SameSite=Strict"
Header edit Set-Cookie ^(.*)$ $1;SameSite=Strict

请让我知道如何使用上述设置来设置SameSite = Strict。

Answer 1

在启用mod_headers后，在我的本地环境（Apache 2.4）中，我可以通过在vhost中添加以下指令来实现此目的：

<ifmodule mod_headers.c>
Header always edit Set-Cookie (.*) "$1; SameSite=strict"
</ifmodule>

区别在哪里？为什么对您不起作用？也许分号后缺少“空格”？

<ifmodule mod_headers.c>
# always is similar to "onerrors"
        Header always edit Set-Cookie (.*) "$1; SameSite=strict"
# success is similar to http 2xx response code
        Header onsuccess edit Set-Cookie (.*) "$1; SameSite=strict"
# remove duplications (apache sends from both tables always and onsuccess)
        ## https://www.tunetheweb.com/security/http-security-headers/secure-cookies/
        #Strip off double SameSite=strict settings as using above you can sometimes get both
        Header edit Set-Cookie ^(.*);\s?SameSite=strict;?\s?(.*);\s?SameSite=strict;?\s?(.*)$ "$1; $2; $3; SameSite=strict"

        #Strip off double ;; settings
        Header edit Set-Cookie ^(.*);\s?;\s?(.*)$ "$1; $2"

</ifmodule>

[apache手册]（https://httpd.apache.org/docs/2.2/de/mod/mod_headers.html）

[堆栈讨论]（httpd duplicate Access-Control-Allow-Origin with "Header always set"）

Answer 2

对于apache2> = 2.2.4

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=Strict

对于低于2.2.4的apache2

Header set Set-Cookie HttpOnly;Secure;SameSite=Strict

如何使用Apache配置设置SameSite Cookie属性？

2 个答案: