Spring Boot 2 Set-Cookie response header missing

Question

please forgive any lack of structure/etiquette, this is my first post.

I have a Java application using Spring Boot (v2.1.6) with annotation based configuration for spring-boot-starter-security and cannot understand how to add the response header of:

 "Set-Cookie: SameSite=strict"

to resolve the warning:

A cookie associated with a cross-site resource at "myApiUrl" was set without the `SameSite` attribute. A future release of Chrome will only deliver cookies with cross-site requests if they are set with `SameSite=None` and `Secure`. You can review cookies in developer tools under Application>Storage>Cookies and see more details at https://www.chromestatus.com/feature/5088147346030592 and https://www.chromestatus.com/feature/5633521622188032.

The full configuration for my HttpSecurity is listed below and I have attempted to add the header in the last portion of the configuration using StaticHeadersWriter as such:

@Override
protected void configure(HttpSecurity http) throws Exception { 
    http
    .csrf().disable()
    .cors()
    .and()
        .exceptionHandling()
        .authenticationEntryPoint(entryPoint) //request is generally sent to entry point when unauthorized
    .and()
    .authorizeRequests()
        .antMatchers("/loggedIn").permitAll()
        .antMatchers("/createUser").permitAll()
        .antMatchers("/deleteUser").hasRole("ADMIN")
        .antMatchers("/fullDB").hasRole("ADMIN")
        .antMatchers("/logs").hasRole("ADMIN")
        .antMatchers("/**").authenticated()
    .and()
    .formLogin()
        .successHandler(new AuthenticationSuccessHandler())
        .failureHandler(new SimpleUrlAuthenticationFailureHandler())
    .and()
    .logout()
        .deleteCookies(cookieName)
        .invalidateHttpSession(true)
        .logoutUrl("/logout")
        .logoutSuccessHandler((new HttpStatusReturningLogoutSuccessHandler(HttpStatus.OK)))
    .and()
        .headers()
        .addHeaderWriter(new StaticHeadersWriter("Set-Cookie", "SameSite=strict"))
        .addHeaderWriter(new StaticHeadersWriter("A-cookie","B=val"))
        .addHeaderWriter(new StaticHeadersWriter("SetCookie","SameSitestrict"));
}

Using the following configuration I am able to receive a valid response with every header except the Set-Cookie header, which appears to get removed and can be seen in the below link.

Image of Response

Additional attempts at resolving this issue that I have tried included adding a redirect in the provided successHandler() to a custom url endpoint, which would then return a ResponseEntity where I could provide the code below, however these attempts also would not have the "Set-Cookie" response header included.

   HttpHeaders httpHeaders = new HttpHeaders();
   httpHeaders.add(HttpHeaders.SET_COOKIE, "SomeName=someId");
   return new ResponseEntity(httpHeaders, HttpStatus.OK);

 or

   response.addCookie(new Cookie("SomeName", "someId"));
   return ResponseEntity.ok().build();

Any advice on how to provide the "Set-Cookie" header on the response from a Spring Boot API call to resolve this chrome warning would be greatly appreciated!

Spring Boot 2 Set-Cookie response header missing

0 Answers