Page MenuHomePhabricator

The "forceHttps" cookie is misusing the recommended “sameSite“ attribute
Closed, InvalidPublic

Description

I get this warning in Firefox's console when I visit any page on fawiki:

Some cookies are misusing the recommended “sameSite“ attribute

Cookie “forceHTTPS” will be soon rejected because it has the “sameSite” attribute set to “none” or an invalid value, without the “secure” attribute. To know more about the “sameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Cookies

Looking at the Network tab of the consol,e I see that forceHTTPS: "true" in the request cookie, and the response cookies read something like this:

forceHttps:
    domain: ".wikipedia.org"
    httpOnly: true,
    path: "/",
    value: "true"

Obviously, there are many network requests and many response cookies, so maybe I am not looking at the problematic one?

Of note, the warning is not shown always; if I keep refreshing the page, sometimes it goes away, sometimes I get it 2 times, and sometimes 3 times.

Per T158604 my impression was that we have not started using sameSite cookies yet. Apparently, we have.

Event Timeline

Krinkle renamed this task from Some cookies are misusing the recommended “sameSite“ attribute to The "forceHttps" cookie is misusing the recommended “sameSite“ attribute.Jun 14 2020, 3:47 PM
tstarling subscribed.

The warning is poorly worded. The cookie does not have a SameSite attribute, so it is implicitly None. The warning is correct that there is a problem that needs to be immediately fixed. I reformulated this as T256095.