From d5600c0e7c86f5e293f0be4417e0e83e0b38b81a Mon Sep 17 00:00:00 2001 From: Chris Cole Date: Wed, 1 Apr 2020 11:00:24 -0700 Subject: [PATCH 1/2] #5011 Fix to set Secure attribute on cookie when SameSite=none --- src/storageManager.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/storageManager.js b/src/storageManager.js index abda0ccb180..2cfe9d57471 100644 --- a/src/storageManager.js +++ b/src/storageManager.js @@ -64,7 +64,9 @@ export function newStorageManager({gvlid, moduleName, moduleType} = {}) { if (result && result.valid) { const domainPortion = (domain && domain !== '') ? ` ;domain=${encodeURIComponent(domain)}` : ''; const expiresPortion = (expires && expires !== '') ? ` ;expires=${expires}` : ''; - document.cookie = `${key}=${encodeURIComponent(value)}${expiresPortion}; path=/${domainPortion}${sameSite ? `; SameSite=${sameSite}` : ''}`; + var isNone = (sameSite != null && sameSite.toLowerCase() == 'none') + var secure = (isNone) ? '; Secure' : ''; + document.cookie = `${key}=${encodeURIComponent(value)}${expiresPortion}; path=/${domainPortion}${sameSite ? `; SameSite=${sameSite}` : ''}${secure}`; } } if (done && typeof done === 'function') { From ef32c05febcdb8d63c2f4668d4e49467d900b8dc Mon Sep 17 00:00:00 2001 From: Chris Cole Date: Thu, 2 Apr 2020 10:57:53 -0700 Subject: [PATCH 2/2] Minor change to use const instead of var per review request. --- src/storageManager.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/storageManager.js b/src/storageManager.js index 2cfe9d57471..75ad10908dc 100644 --- a/src/storageManager.js +++ b/src/storageManager.js @@ -64,8 +64,8 @@ export function newStorageManager({gvlid, moduleName, moduleType} = {}) { if (result && result.valid) { const domainPortion = (domain && domain !== '') ? ` ;domain=${encodeURIComponent(domain)}` : ''; const expiresPortion = (expires && expires !== '') ? ` ;expires=${expires}` : ''; - var isNone = (sameSite != null && sameSite.toLowerCase() == 'none') - var secure = (isNone) ? '; Secure' : ''; + const isNone = (sameSite != null && sameSite.toLowerCase() == 'none') + const secure = (isNone) ? '; Secure' : ''; document.cookie = `${key}=${encodeURIComponent(value)}${expiresPortion}; path=/${domainPortion}${sameSite ? `; SameSite=${sameSite}` : ''}${secure}`; } }