From ab250c2f3a1ac1fa0d7d525fbd903d11c4806f6f Mon Sep 17 00:00:00 2001 From: Oneric Date: Thu, 19 Oct 2023 00:45:11 +0200 Subject: [PATCH] Explicitly set SameSite attribute for cookies Modern browsers start to tighten down on third-party access to cookies. E.g. in current Firefox, a warning about the userLanguage cookie was shown since it did not yet explicitly set the SameSite attribute and the default is about to change. The cookie name being referred to as BACKEND_LANGUAGE_COOKIE_NAME suggests it should be readable by the actual Akkoma backend, which can live at a different domain than akkoma-fe. Thus explicitly enable sharing with third-party sites. No warnings were shown for other cookies, so I assume this was the only one not yet setting SameSite. --- src/modules/config.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/modules/config.js b/src/modules/config.js index ebb27929..2c4e461d 100644 --- a/src/modules/config.js +++ b/src/modules/config.js @@ -229,7 +229,7 @@ const config = { break case 'interfaceLanguage': messages.setLanguage(this.getters.i18n, value) - Cookies.set(BACKEND_LANGUAGE_COOKIE_NAME, localeService.internalToBackendLocale(value)) + Cookies.set(BACKEND_LANGUAGE_COOKIE_NAME, localeService.internalToBackendLocale(value), {sameSite: 'Lax'}) dispatch('setInstanceOption', { name: 'interfaceLanguage', value }) break case 'thirdColumnMode':