How to set SameSite Cookie in Tomcat's Cookie Processor?

tomcat cookies tomcat9 samesite
Puneri picture Puneri · Aug 15, 2019 · Viewed 26.5k times · Source

Tomcat's context.xml defines CookieProcessor (default LegacyCookieProcessor)

https://tomcat.apache.org/tomcat-9.0-doc/config/cookie-processor.html

I'm trying to add attribute(s) shown on cookie processor, however that doesn't seems to be working

I don't see Tomcat's response header cookie with sameSite attribute being set

Answer

Ivan Tsenov picture Ivan Tsenov · Aug 23, 2019

In your web application, inside the META-INF folder create a context.xml file with this inside.

<Context>
   <CookieProcessor sameSiteCookies="strict" />
</Context>

If you already have a context.xml file, you just need to add the CookieProcessor element.

This behavior is possible since Tomcat 9.0.21 and 8.5.42, or 9.0.28 and 8.5.48 if you need to set the attribute to "none".

Merged into Tomcat master on 20th of May 2019 with pull request 162

Related questions

JSESSIONID Cookie with Expiration Date in Tomcat

What's the best way to set an expiration date for the JSESSIONID cookie sent by Tomcat for a servlet session? By default, the expiration date of the cookie seems to be 'session', which means that the session disappears in the …

Read More
Best way for allowing subdomain session cookies using Tomcat

By default tomcat will create a session cookie for the current domain. If you are on www.example.com, your cookie will be created for www.example.com (will only work on www.example.com). Whereas for example.com it …

Read More
How to avoid ;jsessionid=XXX on the first call to a page? it works if first page is jsp

I have an application which uses the welcome-page index.jsp with an <iframe></iframe> the contents of the iframe is a jsf page. If I access index.jsp I see a cookie already on the first …

Read More