webzod
account

Set SameSite on session cookies on nginx

headers.cookies.no_samesite · effort: about an hour

Why it matters

A session cookie without SameSite relies on each browser's default, and some still send it with cross-site requests that can trigger actions as the logged-in visitor. SameSite=Lax stops that for most cross-site requests while normal links keep working.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. Stage 1: check single sign-on and payment return flows as described in the generic steps.
  2. Stage 2: if nginx proxies to the application, set SameSite on that cookie (nginx 1.19.3 or later), replacing session_cookie_name with the name from the finding.
  3. nginx applies only the first proxy_cookie_flags line that matches a cookie. Give each named cookie one line with all its flags, before any catch-all ~ line, as in the snippet. Run sudo nginx -t, reload and test those flows.
nginx 
# named cookies first, each with all of its flags
proxy_cookie_flags session_cookie_name secure httponly samesite=lax;
# a catch-all line, if you have one, goes after every named line
# proxy_cookie_flags ~ secure;

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.