Chrome same-site strategy (Samesite) issues and solutions

1. Change browser Settings. This is a simple and crude way to set the SameSite property back to None. Whether the user wants to or not, the fact that the browser on each machine has to be set up violates the principle that the biggest advantage of BS architecture applications is that the client does not need to be installed and deployed. So I think this is a measure that has to be taken when there is really no other way.

The setting method is as follows:

1) Enter Chrome ://flags in the Chrome address bar. 2) Disable “SameSite by Default cookies” and “cookies without SameSite must be secure”

Set-cookie: SameSite=None Set set-cookie: SameSite=None

Set-Cookie: SameSite=None; Secure
Copy the code

Set-Cookie

Here’s a question: Who sets the set-cookie? Take our project as an example. The page of project A uses iframe to embed the page of project B. Should project A set set-cookie or project B? It’s going to be B. Because it is embedded in the page of B project, the response comes from B server, and A can’t make it work hard.

Notice The Secure attribute must be set at the same time (cookies can only be sent over HTTPS). Otherwise, the Secure attribute is invalid. This means that project B must use HTTPS? But I tried it a few times, and it didn’t work. Maybe my project A itself is HTTP and I need both A and B to be HTTPS? Don’t know.

However, there is an instance where SameSite is set to None. Take the Adobe site as an example:www.adobe.com/sea/, view requests can be…



3. Nginx does site mapping

The SameSite policy targets requests from different stations, so there is no problem with the SameSite. Then project A embedded in the page of project B, map site B to the same site is not good? The same site and homology (non cross domain) is not the same, I feel that the same site than the same to be strict, cross domain, the same top-level domain name can be, with the same site, the domain name to keep the same, port can be different. For mapping, you can use the same domain name or IP address but different ports.

The difference between homology and homology is complicated, and you can see it here.

The best choice for mapping sites is of course Nginx. For example, A project in my local, http://localhost:8081, now embedded in the page of the project, B B project address for http://192.168.0.248:8082/, now need to be mapped to http://localhost:8082.

1) Create an Nginx configuration file /conf/nginx2.conf

worker_processes  1;

error_log  logs/error.log debug;

events {
    worker_connections  1024;
}

http {
    server {
		listen       8082;  
        server_name  localhost;  
		location / {
			proxy_passhttp://192.168.0.248:8082/; }}}Copy the code

2) Run nginx

Nginx. Exe - c D: \ soft \ nginx - RTMP - win32-1.2.1 \ conf \ nginx2 confCopy the code