How do I set the SameSite option on the session cookies?

[lol768]

https://tools.ietf.org/html/draft-west-first-party-cookies-07

[unknwon]

Any examples of other session implementation supports this? Reading RFC is not a easy thing for me.

[lol768]

Hi @unknwon

I've not seen any other Go session providers that do this (I don't use Go much). It's supported by Symfony though: https://github.com/symfony/symfony/blob/64ace101fb/src/Symfony/Component/HttpFoundation/Cookie.php#L45

An ideal implementation for me would look like:

Extend the Options struct

type Options struct {
    // Name of provider. Default is "memory".
    Provider string
    // Provider configuration, it's corresponding to provider.
    ProviderConfig string
    // Cookie name to save session ID. Default is "MacaronSession".
    CookieName string
    // Cookie path to store. Default is "/".
    CookiePath string
    // GC interval time in seconds. Default is 3600.
    Gclifetime int64
    // Max life time in seconds. Default is whatever GC interval time is.
    Maxlifetime int64
    // Use HTTPS only. Default is false.
    Secure bool
    // Cookie life time. Default is 0.
    CookieLifeTime int
    // Cookie domain name. Default is empty.
    Domain string
    // Whether to set the SameSite option
    EnableSameSite bool
    // Value for SameSite option. Default is "Strict" but can be set to "Lax".
    SameSiteValue string
    // Session ID length. Default is 16.
    IDLength int
    // Configuration section name. Default is "session".
    Section string
}

The Set-Cookie header should then look something like Set-Cookie: MacaronSession=x; HttpOnly; SecureOnly; SameSite=Strict

[lol768]

Having a cursory glance at the net/http implementation at https://golang.org/src/net/http/cookie.go, it doesn't look like there's support in this struct for setting SameSite.

golang/go#15867 seems relevant, could try @hkeide's workaround

[unknwon]

Thanks, will take a look!

[lol768]

https://go-review.googlesource.com/c/go/+/79919

This will eventually be in a version of Go.

[unknwon]

@lol768 I'll check if Go 1.10 has included this patch.

Update: seems hasn't been released with Go 1.10.

[lfuelling]

@unknwon seems like it was merged in july 2018, is there any update on seting it in macaron?