[shiro-site] branch master updated: Add info about the SameSite cookie flag

[fp...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

fpapon pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shiro-site.git


The following commit(s) were added to refs/heads/master by this push:
     new d4f6481  Add info about the SameSite cookie flag
     new 7fe8c29  Merge pull request #48 from boris-petrov/patch-1
d4f6481 is described below

commit d4f64811b40dac03f4a32940b92ad96306943ce1
Author: Boris Petrov <bo...@live.com>
AuthorDate: Thu Sep 12 17:54:57 2019 +0300

    Add info about the SameSite cookie flag
---
 web.md.vtl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web.md.vtl b/web.md.vtl
index d9f5f6b..45e4f59 100644
--- a/web.md.vtl
+++ b/web.md.vtl
@@ -535,7 +535,7 @@ securityManager.sessionManager.sessionIdCookie.domain = foo.com
 
 See the [SimpleCookie JavaDoc](static/current/apidocs/org/apache/shiro/web/servlet/SimpleCookie.html) for additional properties.
 
-The cookie's default name is `JSESSIONID` in accordance with the servlet specification. Additionally, Shiro's cookie supports the [`HttpOnly`](https://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie) flag. The `sessionIdCookie` sets `HttpOnly` to `true` by default for extra security.
+The cookie's default name is `JSESSIONID` in accordance with the servlet specification. Additionally, Shiro's cookie supports the [`HttpOnly`](https://en.wikipedia.org/wiki/HTTP_cookie#HttpOnly_cookie) and [`SameSite`](https://en.wikipedia.org/wiki/HTTP_cookie#Same-site_cookie) flags. The `sessionIdCookie` sets `HttpOnly` to `true` and `SameSite` to `LAX` by default for extra security.
 
 #info('Note', 'Shiro''s <code>Cookie</code> concept supports the <code>HttpOnly</code> flag even in Servlet 2.4 and 2.5 environments (whereas the Servlet API only supports it natively in 2.6 or later).')