[PR] DRILL-8522: Change session cookie name. Use STRICT sameSite (drill)

["rymarm (via GitHub)" <gi...@apache.org>]

rymarm opened a new pull request, #2985:
URL: https://github.com/apache/drill/pull/2985

   # [DRILL-8522](https://issues.apache.org/jira/browse/DRILL-8522): Change session cookie name. Use STRICT sameSite
   
   Drill uses Jetty's default cookie name, JSESSIONID, to store the user session ID.
    
   Because JSESSIONID is a generic name, multiple web services running on the same host can conflict if they use the same cookie name.
   
   ## Description
   
   Instead of the generic `JSESSIONID` cookie name, Drill will now use `Drill-Session-Id` for HTTP and `__Secure-Drill-Session-Id` for HTTPS. For HTTPS used `__Secure-` prefix to ensure the cookie is set from secure origin: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#cookie_prefixes
   
   Additionally, the cookie's `sameSite` attribute is now set to `STRICT` for improved security. More info about this configuration you can find here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies#controlling_third-party_cookies_with_samesite
   
   ## Documentation
   \-
   
   ## Testing
   Manual tests 
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] DRILL-8522: Change session cookie name. Use STRICT sameSite (drill)

["rymarm (via GitHub)" <gi...@apache.org>]

rymarm merged PR #2985:
URL: https://github.com/apache/drill/pull/2985


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@drill.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org