[feature request] add support for SameSite cookie attribute

Expected Behavior

Modern browsers support a new attribute SameSite on cookies, to mitigate CSRF attacks. From https://tools.ietf.org/html/draft-west-first-party-cookies-07

This document updates RFC6265 by defining a “SameSite” attribute which allows servers to assert that a cookie ought not to be sent along with cross-site requests. This assertion allows user agents to mitigate the risk of cross-origin information leakage, and provides some protection against cross-site request forgery attacks.

It is enabled by default in Chrome 51, and has public support from Firefox: https://www.chromestatus.com/feature/4672634709082112

I should be able to set the SameSite attribues (either SameSite, SameSite=lax or SameSite=strict) on netty cookies.

Actual behavior

There are no getters/setters for this attribute defined here: https://github.com/netty/netty/blob/4.1/codec-http/src/main/java/io/netty/handler/codec/http/cookie/Cookie.java

Attempting to set this attribute in the value of the cookie results in it being (correctly) escaped.

[AlexLaviolette]

Any update on this? More relevant now with the disclosure of spectre/meltdown

[slandelle]

Not a maintainer either, but I know the answer for sure: Cookie is an API, and it’s not possible to break it until next major release. I’m not aware of any ETA for that, but it should give ample time so see if this draft becomes popular and decide to support if if so.