Merge pull request #2501 from cecilebertin/Fix-2187-Add-SameSite-to-c…

…ookies Fix #2187 - Add SameSite to cookies
mozilla-services · Mar 28, 2017 · ee9a158 · ee9a158
2 parents f423208 + 6fd75c3
commit ee9a158
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/server/src/server.js b/server/src/server.js
@@ -563,8 +563,8 @@ function sendAuthInfo(req, res, params) {
   let encodedAbTests = b64EncodeJson(userAbTests);
   let keygrip = dbschema.getKeygrip();
   let cookies = new Cookies(req, res, {keys: keygrip});
-  cookies.set("user", deviceId, {signed: true});
-  cookies.set("abtests", encodedAbTests, {signed: true});
+  cookies.set("user", deviceId, {signed: true, sameSite: 'lax'});
+  cookies.set("abtests", encodedAbTests, {signed: true, sameSite: 'lax'});
   let authHeader = `${deviceId}:${keygrip.sign(deviceId)};abTests=${encodedAbTests}:${keygrip.sign(encodedAbTests)}`;
   let responseJson = {
     ok: "User created",