Express: Add SameSite option to response.cookie()

Created on 5 Oct 2016 · 6Comments · Source: expressjs/express

Add support for the SameSite flag on cookies.

4.x question

Source

ShimShamSam

Most helpful comment

Thanks for the suggestion! We added it in the 4.14.0 release :)

Here is an example:

$ npm i express
[email protected] node_modules\express
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected] ([email protected])
├── [email protected]
├── [email protected] ([email protected], [email protected])
├── [email protected] ([email protected])
├── [email protected] ([email protected], [email protected])
├── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected])
├── [email protected] ([email protected], [email protected])
└── [email protected] ([email protected], [email protected])

$ cat app.js
var express = require('express')

var app = express()

app.get('/', function (req, res) {
  res.cookie('foo', 'bar', {
    sameSite: true
  })
  res.end()
})

app.listen(4000)

$ node app.js &
[1] 10804

$ curl -Is http://127.0.0.1:4000
HTTP/1.1 200 OK
X-Powered-By: Express
Set-Cookie: foo=bar; Path=/; SameSite=Strict
Date: Wed, 05 Oct 2016 13:24:13 GMT
Connection: keep-alive

dougwilson on 5 Oct 2016

👍5 😄1

All 6 comments

Thanks for the suggestion! We added it in the 4.14.0 release :)

Here is an example:

$ npm i express
[email protected] node_modules\express
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected]
├── [email protected] ([email protected])
├── [email protected]
├── [email protected] ([email protected], [email protected])
├── [email protected] ([email protected])
├── [email protected] ([email protected], [email protected])
├── [email protected] ([email protected], [email protected], [email protected], [email protected], [email protected])
├── [email protected] ([email protected], [email protected])
└── [email protected] ([email protected], [email protected])

$ cat app.js
var express = require('express')

var app = express()

app.get('/', function (req, res) {
  res.cookie('foo', 'bar', {
    sameSite: true
  })
  res.end()
})

app.listen(4000)

$ node app.js &
[1] 10804

$ curl -Is http://127.0.0.1:4000
HTTP/1.1 200 OK
X-Powered-By: Express
Set-Cookie: foo=bar; Path=/; SameSite=Strict
Date: Wed, 05 Oct 2016 13:24:13 GMT
Connection: keep-alive

dougwilson on 5 Oct 2016

👍5 😄1

@dougwilson Support for sameSite is not mentioned in the docs afaict. I discovered it's existence by accident when reading through the code of the cookie NPM package but could not find it in the docs... A Google search then lead me here.