https://jerrywang1981.github.io/categories/k8s/ Recent content in K8s on 村边的池塘 Hugo zh-CN Mon, 27 Feb 2023 09:15:23 +0800 https://jerrywang1981.github.io/post/security/Cookie-with-Insecure-or-Improper-or-Missing-SameSite-attribute/ Mon, 27 Feb 2023 09:15:23 +0800 https://jerrywang1981.github.io/post/security/Cookie-with-Insecure-or-Improper-or-Missing-SameSite-attribute/ Issue Cookie with Insecure or Improper or Missing SameSite attribute Risk Prevent cookie information leakage by restricting cookies to first-party or same-site context, Attacks can extend to Cross-Site- Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens). Cause Sensitive Cookie with Improper or Insecure or Missing SameSite Attribute Fix Review possible solutions for configuring SameSite Cookie attribute to recommended values for K8s, you may edit the ingress configuration, set samesite value nginx.ingress.kubernetes.io/session-cookie-samesite: "Strict"