Package net.shibboleth.shared.spring.servlet.impl

# Class SameSiteCookieHeaderFilter

java.lang.Object
net.shibboleth.shared.servlet.AbstractConditionalFilter
net.shibboleth.shared.spring.servlet.impl.SameSiteCookieHeaderFilter

All Implemented Interfaces:
  `Filter`, `ChainableFilter`, `Ordered`

public class SameSiteCookieHeaderFilter extends AbstractConditionalFilter implements ChainableFilter
Implementation of `Filter` which adds the SameSite attribute to cookies, until the Java API supports it natively, if ever.

Explicitly named cookies are configured and placed into a Map of cookie name to same-site attribute value.

All other cookies may be assigned a default value.

Cookies with an existing same-site cookie flag are left unaltered - copied back into the response without modification.

A single cookie can only have at most one same-site value set. Attempts in the configuration to give more than one same-site value to a cookie are caught during argument injection and throw an `IllegalArgumentException`.

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`private class`
`SameSiteCookieHeaderFilter.SameSiteResponseProxy`
An implementation of the `HttpServletResponse` which adds the same-site flag to Set-Cookie headers for the set of configured cookies.
`static enum`
`SameSiteCookieHeaderFilter.SameSiteValue`
The allowed same-site cookie attribute values.

## Nested classes/interfaces inherited from interface net.shibboleth.shared.spring.servlet.ChainableFilter

`ChainableFilter.FilterOrder`

## Field Summary

Fields
Modifier and Type
Field
Description
`private SameSiteCookieHeaderFilter.SameSiteValue`
`defaultValue`
Optional default value to apply.
`private boolean`
`disableBasedOnServletAPI`
Whether to disable automatically on newer API.
`private final org.slf4j.Logger`
`log`
Class logger.
`private static final String`
`SAMESITE_ATTRIBITE_NAME`
The name of the same-site cookie attribute.
`private Map<String,SameSiteCookieHeaderFilter.SameSiteValue>`
`sameSiteCookies`
Map of cookie name to same-site attribute value.

### Fields inherited from interface org.springframework.core.Ordered

`HIGHEST_PRECEDENCE, LOWEST_PRECEDENCE`

## Constructor Summary

Constructors
Constructor
Description
`SameSiteCookieHeaderFilter()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`void`
`destroy()`
`void`
`doFilter(ServletRequest request, ServletResponse response, FilterChain chain)`
`int`
`getOrder()`
`void`
`init(FilterConfig filterConfig)`
`protected void`
`runFilter(ServletRequest request, ServletResponse response, FilterChain chain)`
Subclasses should override this method to be called when the filter is directed to activate.
`void`
`setDefaultValue(SameSiteCookieHeaderFilter.SameSiteValue value)`
Set an optional default value to apply to all unmapped cookies.
`void`
`setDisableBasedOnServletAPI(boolean flag)`
Sets whether to automatically disable filter if servlet API has native SameSite support.
`void`
`setSameSiteCookies(Map<SameSiteCookieHeaderFilter.SameSiteValue,List<String>> map)`
Set the names of cookies to add the same-site attribute to.

### Methods inherited from class net.shibboleth.shared.servlet.AbstractConditionalFilter

`getActivationCondition, setActivationCondition`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### SAMESITE_ATTRIBITE_NAME

@Nonnull @NotEmpty private static final String SAMESITE_ATTRIBITE_NAME
The name of the same-site cookie attribute.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### disableBasedOnServletAPI

private boolean disableBasedOnServletAPI
Whether to disable automatically on newer API.

### defaultValue

@Nullable private SameSiteCookieHeaderFilter.SameSiteValue defaultValue
Optional default value to apply.

### sameSiteCookies

@Nonnull private Map<String,SameSiteCookieHeaderFilter.SameSiteValue> sameSiteCookies
Map of cookie name to same-site attribute value.

## Constructor Details

### SameSiteCookieHeaderFilter

public SameSiteCookieHeaderFilter()
Constructor.

## Method Details

### setDisableBasedOnServletAPI

public void setDisableBasedOnServletAPI(boolean flag)
Sets whether to automatically disable filter if servlet API has native SameSite support.

Defaults to true.

Parameters:
  `flag` - flag to set
Since:
  5.2.0

### setDefaultValue

public void setDefaultValue(@Nullable SameSiteCookieHeaderFilter.SameSiteValue value)
Set an optional default value to apply to all unmapped cookies.

Parameters:
  `value` - default value

### setSameSiteCookies

public void setSameSiteCookies(@Nullable Map<SameSiteCookieHeaderFilter.SameSiteValue,List<String>> map)
Set the names of cookies to add the same-site attribute to.

The argument map is flattened to remove the nested collection. The argument map allows duplicate cookie names to appear in order to detect configuration errors which would otherwise not be found during argument injection e.g. trying to set a session identifier cookie as both SameSite=Strict and SameSite=None. Instead, duplicates are detected here, throwing a terminating `IllegalArgumentException` if found.

Parameters:
  `map` - the map of same-site attribute values to cookie names

### init

public void init(FilterConfig filterConfig) throws ServletException

Specified by:
  `init` in interface `Filter`
Overrides:
  `init` in class `AbstractConditionalFilter`
Throws:
  `ServletException`

### destroy

public void destroy()

Specified by:
  `destroy` in interface `Filter`
Overrides:
  `destroy` in class `AbstractConditionalFilter`

### getOrder

public int getOrder()

Specified by:
  `getOrder` in interface `ChainableFilter`
Specified by:
  `getOrder` in interface `Ordered`

### doFilter

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException

Specified by:
  `doFilter` in interface `Filter`
Overrides:
  `doFilter` in class `AbstractConditionalFilter`
Throws:
  `IOException`
  `ServletException`

### runFilter

protected void runFilter(@Nonnull ServletRequest request, @Nonnull ServletResponse response, @Nonnull FilterChain chain) throws IOException, ServletException
Subclasses should override this method to be called when the filter is directed to activate.

Specified by:
  `runFilter` in class `AbstractConditionalFilter`
Parameters:
  `request` - servlet request
  `response` - servlet response
  `chain` - filter chain
Throws:
  `IOException` - on error
  `ServletException` - on error