1

I want to set cookie 'samesite' attribute in weblogic deployment descriptor but don't see any option for 'samesite' attribute like we have for 'httpOnly' and 'Secure'.

<cookie-http-only>true</cookie-http-only>
<cookie-secure>true</cookie-secure>

Is there any tag to set the 'samesite' attribute?

Thanks in advance.

3 Answers 3

0

In cookie-domain put the value ";SameSite=none" Doing it in cookie-comment won't work since JSESSIONID is a version 0 cookie (netscape). I've searched for a way to activate version 1 without success.

Hope this helps as a workaround while the request is fulfilled by oracle and a patch will be soon available.

1
  • It works fine for Chrome and firefox, but old edge and ie versions are not even sending session cookies to first-party req itself. Can you suggest any common fix. Commented Apr 6, 2020 at 11:39
0

There is bug/request filed under the number "28055873 : CSRF TOKEN IMPLEMENTATION FOR WEBLOGIC PRODUCT". So there isn't an option to use the samesite attribute.

0

It's working after appending ";SameSite=none" in cookie-domain:

<cookie-http-only>true</cookie-http-only>
<cookie-secure>true</cookie-secure>
<cookie-domain>.test.com;SameSite=none</cookie-domain>
1
  • Hi, From which version of weblogic did this start working?
    – kz2014
    Commented Apr 3, 2020 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.