Page MenuHomePhabricator

NetworkProbeLimit cookie should set samesite attribute
Open, LowPublic

Description

Related to T335637: Set cookie in Varnish to start a probe

Results in browser console spam currently

Screenshot 2023-07-25 at 12.43.27.png (347×2 px, 269 KB)

Cookie “NetworkProbeLimit” does not have a proper “SameSite” attribute value. Soon, cookies without the “SameSite” attribute or with an invalid value will be treated as “Lax”. This means that the cookie will no longer be sent in third-party contexts. If your application depends on this cookie being available in such contexts, please add the “SameSite=None“ attribute to it. To know more about the “SameSite“ attribute, read https://developer.mozilla.org/docs/Web/HTTP/Headers/Set-Cookie/SameSite

Event Timeline

Change 989457 had a related patch set uploaded (by Ayounsi; author: Ayounsi):

[operations/puppet@production] Add SameSite=strict attribute to NetworkProbeLimit cookie

https://gerrit.wikimedia.org/r/989457

CDanis triaged this task as Low priority.

Change #989457 merged by CDanis:

[operations/puppet@production] Add SameSite=Lax attribute to NetworkProbeLimit cookie

https://gerrit.wikimedia.org/r/989457