How to append SameSite=None to Set-Cookie?

[rohitkrishna-marneni]

I have an endpoint which returns a set of cookies. However I need to append(or modify) these cookies so that they have SameSite=None attribute set. More about SameSite.

So I have my yml configuration like this.

services:
  - name: my-service
    upstream: # my upstream information
      name: my-upstream
      #...
    routes:
      - name: my-first-route
        hosts:
          - "my-service.com"
        uris:
          - /my-service
        plugins:
          response-rewrite:
            body_base64: false
            headers:
              set:
                Set-Cookie: "uuid=12345; SameSite=None"

I am able to modify the cookie uuid, however its actual settings like path=/ is being overriden. Also with this approach I can only append SameSite=None to one cookie(which is uuid in my case). However I want to append SameSite=None to all my cookies which are sent in set-cookie header after a call to endpoint /my-service.

Is there a way to do it in apisix?

[dosubot[bot]]

Hey @rohitkrishna-marneni! 👋 I'm here to help you with any bugs, questions, or contributions you have. Let's tackle this together!

Currently, the response-rewrite plugin in APISIX allows you to set or overwrite headers, including Set-Cookie headers, but it does not support appending attributes to existing cookies without overwriting other attributes. This means that when you use the set option, it replaces the entire Set-Cookie header, which is why the original settings like path=/ are being overridden.

Unfortunately, there isn't a built-in feature in APISIX to dynamically append attributes like SameSite=None to all cookies in a response without specifying each cookie individually. You would need to handle this logic externally or modify the plugin to support such functionality.

If you need to apply SameSite=None to all cookies, you might consider implementing a custom plugin or using a Lua script to parse and modify the Set-Cookie headers as needed.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

[rohitkrishna-marneni]

@dosu How to write a plugin for this usecase?

[dosubot[bot]]

To write a custom plugin in APISIX for appending SameSite=None to all Set-Cookie headers, follow these steps:

1. Create the Plugin File: Place your plugin in the apisix/plugins directory. For example, create a file named set_cookie_samesite.lua.

2. Define the Plugin Structure: Implement the necessary methods for your plugin, such as schema, check_schema, and header_filter.

3. Modify the Set-Cookie Headers: Use the header_filter phase to iterate over the Set-Cookie headers and append SameSite=None to each one.

Here's a basic example of how your plugin might look:

local core = require("apisix.core")
local plugin_name = "set_cookie_samesite"

local schema = {
    type = "object",
    properties = {},
}

local _M = {
    version = 0.1,
    priority = 1000,  -- Set a priority for your plugin
    name = plugin_name,
    schema = schema,
}

function _M.check_schema(conf)
    return core.schema.check(schema, conf)
end

function _M.header_filter(conf, ctx)
    local set_cookie = core.response.get_header("Set-Cookie")
    if not set_cookie then
        return
    end

    if type(set_cookie) == "string" then
        set_cookie = {set_cookie}
    end

    for i, cookie in ipairs(set_cookie) do
        if not cookie:find("SameSite") then
            set_cookie[i] = cookie .. "; SameSite=None"
        end
    end

    core.response.set_header("Set-Cookie", set_cookie)
end

return _M

4. Configure APISIX: Add your plugin to the config.yaml file under the plugins section to ensure it is loaded by APISIX.

5. Test Your Plugin: Deploy your plugin and test it by making requests to your service to ensure that the Set-Cookie headers are modified as expected.

By following these steps, you can create a custom plugin to append SameSite=None to all Set-Cookie headers in APISIX.

To continue talking to Dosu, mention @dosu.

---

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}